Mailbox Hunting

What mailbox hunting targets

Mailbox hunting is not about a single inbox, but about finding email accounts that can be leveraged as access points, observation points, or persistence points inside an organisation. The target may be a normal user mailbox, a shared mailbox, a delegated mailbox, or an account with stale access that still accepts messages and actions.

The core idea is exposure. Attackers prefer mailboxes that are easy to abuse because they are externally reachable, weakly protected, or already trusted by internal users. Once a mailbox is found, it can become a platform for internal reconnaissance, phishing from a legitimate-looking sender, or interception of sensitive correspondence.

Why mailbox hunting matters

Mail systems carry business communication, password resets, approvals, invoices, and other high-value messages, so a compromised mailbox can reveal both data and trust relationships. A mailbox may also contain forwarding rules, recovery emails, shared access, or historical conversations that help an attacker understand who to impersonate next.

Mailbox hunting is dangerous because the mailbox itself can be less important than the access it represents. If an attacker can read mail, they can often infer workflows, identify privileged users, and gather the context needed for lateral movement. That makes mailbox exposure more than a confidentiality issue, it can become an entry point into broader account abuse.

Mailbox abuse often overlaps with credential and session compromise. If the mailbox is linked to password resets, single sign-on workflows, or delegated access, the attacker may be able to extend the compromise beyond email into other systems that trust the account.

Common mailbox abuse patterns

Attackers typically look for mailboxes that are left open through weak permissions, overbroad delegation, forgotten service accounts, or poor lifecycle management. They also look for inboxes that are already receiving important notifications, because those are more useful for monitoring and impersonation than a dormant account.

• Exposed mailboxes with weak or reused credentials.
• Shared or delegated mailboxes with excessive access.
• Forgotten accounts that still receive mail or retain permissions.
• Forwarding rules or mail flow settings that silently copy messages elsewhere.
• Mailboxes tied to password resets, approvals, or sensitive workflows.

These patterns matter because mailbox hunting is usually opportunistic. Attackers do not need every mailbox, only one that gives them visibility or leverage. The risk rises when mail permissions are inconsistent across teams, subsidiaries, or legacy accounts.

How organisations reduce exposure

Mailbox hunting is harder when organisations maintain a current mailbox inventory, review who can access shared mailboxes, and remove stale delegation promptly. Email systems should be treated as part of the identity surface, because mailbox access often depends on authentication strength, access policy, and account lifecycle hygiene.

It also helps to apply strong mail-access controls and monitor for unusual inbox rule changes, logins from new locations, repeated mailbox enumeration, and unexpected forwarding. The objective is to make mailbox discovery less rewarding and mailbox misuse more visible.

Authoritative control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls maps well to mailbox access governance, while NIST SP 800-63 Digital Identity Guidelines is useful where strong authentication reduces the chance that a mailbox becomes a compromise foothold.

Detection and incident response

Mailbox hunting often leaves behavioural clues before it becomes obvious. Suspicious mailbox access, newly created forwarding rules, consent to unexpected mail clients, unfamiliar delegation changes, and unusual reads of executive or finance mailboxes can all indicate abuse.

After suspected compromise, organisations should review mailbox rules, delegated permissions, sent items, login history, OAuth grants where relevant, and evidence of mailbox-driven phishing or internal reconnaissance. If the mailbox was used to reset passwords, approve access, or request tokens, those downstream trust paths should be checked as well.

For threat-path analysis and adversary tradecraft, MITRE ATT&CK Enterprise Matrix is a useful reference for credential access, privilege escalation, and lateral movement patterns that often follow mailbox compromise. Where mail systems expose API or service interfaces, OWASP API Security Top 10 helps frame abuse of exposed mail services and authorisation failures.

Risk and Threat Considerations

Mailbox hunting is a high-value technique because a mailbox can combine sensitive content, trusted sender identity, and access to adjacent systems. The threat is not limited to reading email, it can enable impersonation, selective phishing, invoice fraud, and discovery of high-privilege relationships inside the organisation.

Failure mechanism: Weak mailbox permissions, stale delegation, exposed credentials, or poor monitoring allow an attacker to locate a mailbox that can be read or used without triggering immediate suspicion. From there, the mailbox becomes a trusted platform for collecting intelligence and extending access.

Impact: The result can include message interception, internal phishing, password-reset abuse, compromise of related accounts, and loss of confidentiality across business processes that rely on email trust.

Practitioner Guidance

Why practitioners should care: Mailboxes are often treated as ordinary collaboration tools, but they can function as trust anchors for access recovery, workflow approvals, and internal impersonation. That makes mailbox governance a security control, not just an email administration task.

What to watch for: Revisit any mailbox that has shared access, forwarding enabled, broad delegation, or unclear ownership. Those are the conditions most likely to turn a routine inbox into a durable abuse path.

Practitioner takeaway: The safest mailbox is the one with explicit ownership, minimal delegation, and monitoring that makes abnormal use visible before it becomes a compromise path.

Related resources from NHI Mgmt Group

• When should teams use mailbox impersonation or discovery rights during email threat hunting?
• Why do virtualization drivers create such difficult bug-hunting conditions?
• How should security teams use AI for browser threat hunting without creating false confidence?
• Why do browser-based attacks need different hunting controls than endpoint threats?