New-InboxRule is a PowerShell cmdlet used to create an inbox rule in Exchange or Exchange Online. It defines actions such as moving, deleting, forwarding or marking messages, and is often monitored because malicious rules can hide messages or redirect mail.
What New-InboxRule Does in Exchange
New-InboxRule is not just a convenience cmdlet, it creates a mailbox rule that can change how messages are handled after delivery. That matters because inbox rules can quietly move, delete, forward, or hide mail, which makes them useful for legitimate automation but also attractive to attackers who want to intercept communications.
Because the command operates on mailbox-side processing, the rule can take effect without changing the sender’s behaviour or the message content itself. In practice, that means the security question is less about whether email still arrives and more about whether the right person still sees it.
Why Inbox Rules Are Security-Relevant
Inbox rules become security-relevant when they are used to conceal activity or reroute messages away from the mailbox owner. A malicious rule can suppress alerts, redirect invoices or password resets, or create a stealthy collection path that is hard to notice in day-to-day mail use.
This is especially important in Microsoft 365 environments where mail access, forwarding behaviour, and mailbox auditing often need to be correlated. The rule itself is only one control point, but it can sit inside a wider compromise chain that includes mailbox access, app permissions, or suspicious forwarding configuration. For a detection-oriented view of the mailbox events that matter, see Microsoft 365 Unified Audit Log Guide for Detection.
Common Abuse Patterns and Detection Signals
Attackers commonly use inbox rules after gaining access to an account so they can maintain visibility into incoming mail or suppress the victim’s awareness. Patterns that deserve attention include rules that forward to external addresses, auto-delete specific senders, move security notifications, or hide mail in less visible folders.
Detection usually depends on finding the rule creation event and then reviewing the rule logic in context. A rule may look harmless in isolation, but the combination of sender conditions, redirection actions, and mailbox access history can reveal business email compromise, mailbox theft, or post-compromise persistence. A focused guide on this attack pattern is T1114 Email Collection Defensive Guide.
Governance and Control Around Inbox Rule Creation
Inbox rule creation should be governed as a mailbox change with security impact, not as a routine convenience feature. Organisations need visibility into who can create rules, whether external forwarding is allowed, and how rule activity is audited across mailboxes and administrative roles.
That governance becomes stronger when the mailbox audit trail, forwarding controls, and identity posture are reviewed together. If rules are being created by unexpected users, by delegated access, or immediately after suspicious sign-in activity, the issue is usually broader than the rule itself. Where mail-rule activity is part of a larger adversary path, T1114 Email Collection Defensive Guide helps connect the mailbox behaviour to the likely compromise pattern.
Risk and Threat Considerations
Inbox rules matter because they can convert a one-time mailbox compromise into quiet, ongoing message interception. They are a low-noise way to hide evidence, harvest sensitive correspondence, and preserve access to password resets, invoices, legal notices, and internal approvals.
Failure mechanism: an attacker creates or modifies a rule after gaining mailbox access, then uses the rule to suppress, redirect, or bury messages so the user does not notice the compromise.
Impact: the mailbox owner can lose visibility into critical email, while the attacker gains persistence, collection capability, and a better chance of abusing the account for follow-on fraud or lateral compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | Covers attacker use of inbox rules and forwarding to collect email secretly. |
| Recommendation — Map mailbox rule abuse to T1114 and hunt for rule creation, forwarding, and hidden-mail activity. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Mailbox rule creation and forwarding changes require auditable security events. |
| AC-2 — Account Management | Inbox rules are governed through account and mailbox access controls. | |
| IA-5 — Authenticator Management | Mailbox-rule abuse often follows stolen credentials and weak authenticator hygiene. | |
| Recommendation — Log inbox rule changes and review them with related mailbox and sign-in events. Restrict who can create or alter mailbox rules and review delegated access regularly. Rotate compromised credentials and tighten authenticator controls after suspicious rule activity. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account governance and review help detect mailbox-rule abuse and hidden forwarding. |
| Recommendation — Review mailbox account changes and remove unauthorized rule-creation paths promptly. | ||
Practitioner Guidance
What to watch for: treat new rule creation, rule changes, and unexpected forwarding destinations as security events, not just user preferences. Review them alongside sign-in anomalies, mailbox access, and any recent credential reset or consent activity.
Practitioner takeaway: the safest way to handle New-InboxRule is to monitor it as part of mailbox compromise detection, then decide whether the rule is legitimate before allowing it to persist.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org