Suspicious Inbox Rules

What Suspicious Inbox Rules Are

Suspicious inbox rules are mailbox filters that a user did not expect to exist, but which redirect, hide, delete, or forward email in ways that benefit an attacker. They are often created after account compromise and are designed to reduce visibility, delay response, or keep the intrusion quiet.

How Suspicious Inbox Rules Work in a Mailbox Takeover

Inbox rules can sort messages by sender, subject, keywords, or attachment content, and then move mail to another folder, mark it as read, archive it, delete it, or forward it elsewhere. In a compromise, that flexibility becomes a stealth mechanism: security alerts, password resets, invoice approvals, and internal replies can be diverted before the owner notices.

Because the rule runs inside the mailbox itself, it can look like ordinary user configuration rather than an active intrusion. That is what makes suspicious rules so effective in business email compromise and other mailbox-takeover cases, especially when attackers want to stay in the conversation rather than immediately lock the owner out.

Why Suspicious Inbox Rules Matter to Detection

Suspicious inbox rules are important because they can defeat the most obvious sign of compromise, visible email. A mailbox may continue to receive mail normally while the owner sees only a curated subset, which means defenders can miss the intrusion unless they inspect rule changes, forwarding behavior, and related mailbox activity.

This is why mailbox auditing, message trace review, and rule-change telemetry matter together. If the compromise only shows up as missing messages or delayed replies, the underlying issue may be a hidden forwarding or filtering rule rather than a broken mail delivery path.

For deeper context on how forwarding and collection techniques fit into adversary behavior, see T1114 Email Collection Defensive Guide and MITRE ATT&CK T1586 Compromise Accounts Guide.

Common Patterns That Make a Rule Suspicious

The most concerning rules are the ones that deliberately reduce scrutiny, such as moving messages out of the inbox, deleting alerts, forwarding mail externally, or hiding replies from specific contacts. A rule is also suspicious when it appears suddenly, uses vague criteria, or targets mail from finance, executives, identity providers, or security systems.

In many investigations, the rule is paired with attacker actions such as session persistence, mailbox delegation abuse, or consent-based access to the account. The rule is not the compromise itself, but it is often the mechanism that lets the compromise continue unnoticed.

For practical email-security hardening and Exchange-specific controls around forwarding and auditing, see Exchange Online Security Guide and Microsoft 365 Unified Audit Log Guide for Detection.

What to Check After You Find One

When suspicious inbox rules appear, treat them as evidence of mailbox compromise until proven otherwise. Review the full rule set, recent sign-ins, forwarding settings, delegated mailbox access, OAuth consent, and message access patterns so you can determine whether the rule was user-created, malicious, or left behind after an attacker removed direct access.

After removing the rule, review whether the attacker may have already read mail, captured replies, or used the mailbox to target others. If the mailbox was used for fraud, reply interception, or payment diversion, the account may have been only one part of a wider business email compromise campaign.

For incident handling and recovery steps, the most relevant operational references are Business Email Compromise Response Playbook and Hacked Social Media or Email Account Recovery Guide.

Risk and Threat Considerations

Suspicious inbox rules create a quiet but material compromise risk because they can hide evidence, suppress alerts, and keep an attacker embedded in a mailbox after the initial takeover. The same rule that makes email easier for the owner can also make it easier for the attacker to monitor conversations and redirect sensitive replies.

Failure mechanism: An attacker who gains mailbox access creates or edits rules that move, forward, or delete messages before the owner sees them, which reduces visibility and preserves attacker control.

Impact: The organisation may miss password resets, invoice changes, legal notices, or fraud alerts, and the attacker can use the mailbox to deepen account takeover or extend business email compromise.

Practitioner Guidance

Why practitioners should care: Inbox rules are a control point, not just a user convenience feature. Teams should treat unexpected rule creation, especially forwarding or delete rules, as a high-signal indicator of mailbox abuse and investigate it alongside session activity and sign-in logs.

What to watch for: Look for new rules created near suspicious logins, rules that target security mail or finance mail, and rules that forward outside the tenant or hide mail from the inbox without an obvious business reason.

Practitioner takeaway: The safest assumption is that a suspicious inbox rule is evidence of attacker intent, even if the mailbox still appears functional.

Related resources from NHI Mgmt Group

• Guide: Email Identity and BEC Guide
• How should teams investigate suspicious Exchange inbox rules end to end?
• How do you detect suspicious inbox forwarding and manipulation rules in Microsoft 365?
• How should security teams detect malicious inbox rules that use Unicode obfuscation?
• Why do inbox rules create persistence risk in Microsoft Exchange?