How do you detect suspicious inbox forwarding and manipulation rules in Microsoft 365?

What suspicious forwarding rules usually look like in Microsoft 365

Mailbox forwarding abuse is often less obvious than a full inbox takeover. In Microsoft 365, the most suspicious patterns are rules that forward messages to an external address, delete or move security alerts, auto-mark mail as read, hide replies, or suppress conversations from the inbox while leaving the account apparently healthy.

The practical problem is that these rules can preserve attacker visibility and persistence after they lose password access or MFA access. A mailbox rule can become a quiet exfiltration path, especially when it is combined with consented OAuth access, stolen session tokens, or a compromised executive mailbox that receives sensitive business mail.

Because the rule itself is often the artifact, not the compromise, you need to treat suspicious rules as both a detection signal and a compromise indicator. Review inbox rules, forwarding settings, transport rules, and any mailbox-level delegate changes together rather than as isolated events.

How to correlate rule activity with likely compromise

Rule abuse is most convincing when it lines up with other identity and mail signals. Look for a new forwarding target appearing soon after an anomalous sign-in, especially from a new country, unfamiliar device, legacy authentication path, or impossible travel pattern. Also check for unusual outbound mail volume, new sent items, or replies disappearing from the expected conversation flow.

It is useful to separate normal automation from suspicious manipulation. Legitimate rules usually support workflow, while malicious rules often reduce visibility, accelerate external delivery, or interfere with the user's ability to notice alerts. That is why executive, finance, legal, and helpdesk accounts deserve closer review, because they are disproportionately valuable for fraud, internal deception, and follow-on phishing.

NHIMG’s Email Identity and BEC Guide is the best place to anchor the broader mailbox-abuse pattern, including inbox rules, mailbox takeover, and payment-fraud conditions that often accompany forwarding abuse.

The same mailbox findings should be checked against tenant telemetry. If the mailbox rule appeared after a risky sign-in, OAuth consent event, password reset, or MFA fatigue event, treat the rule as part of the intrusion chain rather than as an isolated configuration issue.

What to review and remove first in Microsoft 365

Start with the simplest high-risk indicators: any rule that forwards mail outside the organisation, any rule that deletes, archives, or hides security or admin notifications, and any rule that alters message state without user intent. Then review whether the mailbox has external forwarding enabled at the tenant level, because a user rule and a tenant setting can reinforce each other.

Next, check whether the rule was created by the mailbox owner, by a delegated user, or by an application or process that should not be modifying mail flow. If the change source is unclear, the safest assumption is that the mailbox has been abused until proven otherwise.

The most important operational decision is speed. If the forwarding target is unauthorised, remove the rule quickly, preserve the evidence, and verify that the attacker did not add a second path such as a hidden inbox rule, transport rule, or alternate forwarding mechanism.

For a broader Microsoft 365 hardening baseline, Microsoft 365 Security Guide is useful for the control context around audit logs, mailbox auditing, sign-in controls, and Exchange settings that support this kind of investigation.

When the environment uses SaaS broadly, the same response should be aligned with tenant drift and access governance. NHIMG’s SaaS Security Guide is relevant where mailbox forwarding is one symptom of wider SaaS misconfiguration or identity sprawl.

Risk and Threat Considerations

Suspicious inbox forwarding rules matter because they can create silent data exposure, persistence, and message tampering even when the user still has access to the mailbox. An attacker who can redirect, suppress, or auto-process mail can continue harvesting sensitive messages, intercept approvals, and hide defensive notifications.

Failure mechanism: The attacker gains mailbox control or rule-modification access, then creates rules that divert messages externally, remove alerts, or obscure replies. Because the mailbox still looks usable, the abuse can persist until sign-in anomalies, message-flow anomalies, or recipient complaints expose it.

Impact: Sensitive mail can leave the tenant unnoticed, finance and executive communications can be intercepted, and the mailbox can remain a launch point for business email compromise, internal phishing, and payment manipulation.

Practitioner Guidance

What to prioritise: Focus first on accounts that can change money movement, approvals, legal correspondence, or privileged internal workflows. A suspicious rule on one of those mailboxes is higher value than the same rule on a low-risk shared mailbox.

What to verify: Confirm the forwarding target, the rule creator, the timestamp, and whether the mailbox shows other compromise signals such as anomalous sign-in, consent grants, password reset activity, or unexpected outbound mail. Do not trust the rule state alone.

Decision rule: If the rule forwards externally or suppresses security visibility and the owner cannot clearly justify it, treat it as unauthorised until proven otherwise, remove it, and investigate for earlier mailbox compromise before restoring normal access.

Practitioner takeaway: The real question is not whether the rule exists, but whether it gives an attacker a durable and quiet way to keep reading or shaping mail after the initial access event.

Related resources from NHI Mgmt Group

• Why do inbox rules and external forwarding make Microsoft 365 BEC attacks harder to detect?
• How do you detect Microsoft 365 activity from anonymous or suspicious IP addresses?
• How do you detect suspicious OAuth app file download activity in Microsoft 365?
• What should you monitor to detect suspicious device activity in Microsoft Entra ID?