Malicious inbox rules in Microsoft 365 are one of the quietest tools an attacker has. They need no malware, they survive a password reset, and the mailbox owner almost never notices them. A rule that moves every reply about an invoice into an obscure folder can hide a fraud for weeks.
This article explains how attackers use inbox rules, what the suspicious ones look like, how to find them across your whole tenant, and how to stop them coming back.
Why attackers love inbox rules
An inbox rule is a normal Outlook feature: “when a message arrives that matches X, do Y.” Users create them to file newsletters. Attackers create them for three reasons:
Hiding. Replies from the real supplier or client, or security warnings from your bank, get moved away before the user sees them.
Stealing. Messages matching words like “invoice”, “payroll”, or “password” get forwarded to an outside address.
Persisting. Rules are stored server-side in Exchange Online. Changing the user’s password does not remove them. The rule keeps working after the attacker loses access to the account.
In the compromised mailboxes I investigate, a malicious inbox rule is one of the most common things left behind, and removing it is a step that gets missed when someone only resets the password.
Here is how it typically plays out. An attacker phishes the office manager’s password and signs in. Within minutes they create a rule: any message from the company’s main supplier, or containing the word “invoice”, is marked as read and moved to RSS Subscriptions. They then email accounts payable from the real mailbox with new bank details. When the supplier later replies to ask why they have not been paid, that reply goes straight into the hidden folder. The office manager sees nothing unusual. Weeks can pass before anyone connects the dots.
What a malicious rule usually looks like
Attackers want their rules to be invisible and forgettable. The same patterns show up again and again.
Subject or body contains “invoice”, “payment”, “wire”, “bank”
Targets the fraud conversation
Targets a specific sender
From contains the CFO, a key supplier, or the bank
Intercepts the person who could expose the fraud
Forwards or redirects externally
Forward to a free webmail address
Data theft
One of these alone is not proof. A user really might file a supplier’s emails into Archive. Two or three together, especially with a meaningless name, deserve a closer look.
How to find malicious inbox rules
Check one mailbox
The quickest way is Exchange Online PowerShell. After connecting with Connect-ExchangeOnline, run:
The -IncludeHidden switch matters. Some rules created through low-level mailbox APIs do not appear in Outlook or Outlook on the web, but PowerShell can still see them. The Description field gives a readable summary of what each rule does.
Check every mailbox
For a tenant-wide sweep, loop through mailboxes and export any rule that forwards, redirects, deletes, or moves to unusual folders. A simple approach:
Get all user mailboxes with Get-Mailbox -ResultSize Unlimited.
For each one, run Get-InboxRule -IncludeHidden.
Keep rules where ForwardTo, ForwardAsAttachmentTo, RedirectTo, or DeleteMessage is set, or where MoveToFolder points to RSS, Archive, or Conversation History.
Export the results to CSV and review them with someone who knows the users.
In a 100-mailbox tenant this takes minutes and is worth doing every quarter.
Check the audit log
In the Microsoft Purview portal, search the audit log for the operations New-InboxRule, Set-InboxRule, and UpdateInboxRules. Look at the IP address and time of each event. A rule created from an unfamiliar country at 3 a.m., minutes after a suspicious sign-in, tells you a lot. This only works if audit logging was turned on before the incident.
Watch the alerts
Microsoft Defender XDR raises alerts for suspicious inbox manipulation and suspicious forwarding. These are some of the most valuable alerts a small business can act on. Make sure they reach a person, not an unread mailbox.
Removing a malicious rule properly
If you find a malicious rule, treat the account as compromised. Removing the rule alone leaves the door open.
Record the rule details (screenshot or export) for your investigation notes.
Reset the user’s password and revoke all sign-in sessions.
Review and remove any MFA methods the user does not recognize.
Remove the rule with Remove-InboxRule, or disable it first with Disable-InboxRule if you need to preserve it.
Check for mailbox-level forwarding (set on the mailbox itself, not as a rule) and remove it.
Review app consents for the user in Microsoft Entra ID.
Search the audit log and Sent Items to understand what the attacker read or sent.
Check the folders the rule moved mail into. Those messages are often the most important evidence.
Preventing the damage in the first place
You cannot stop users from creating inbox rules, and you would not want to. You can make malicious ones far less useful.
Block automatic external forwarding in the outbound anti-spam policy in the Defender portal. Set it to Off – Forwarding is disabled. This neutralizes forwarding rules to outside addresses for every mailbox at once.
Enforce MFA and block legacy authentication so attackers struggle to get into the mailbox in the first place.
Require phishing-resistant MFA for finance and leadership, the mailboxes attackers most want.
Turn on audit logging and keep logs long enough to investigate.
Send inbox manipulation alerts to someone who will act on them the same day.
Run a quarterly rule sweep using the PowerShell approach above.
Does changing the password remove malicious inbox rules?
No. Inbox rules are stored in the mailbox and keep running after a password reset. You have to find and remove them separately, which is why they are such an effective persistence trick.
Why can I not see the rule in Outlook?
Some rules are created in ways that hide them from Outlook and Outlook on the web. Use Get-InboxRule with the -IncludeHidden switch in Exchange Online PowerShell to see every rule on the mailbox.
Should we block users from creating inbox rules?
Usually not. Rules are useful for staff. It is more practical to block external forwarding, monitor for suspicious rule creation, and review rules regularly.
Worried a mailbox in your tenant has a hidden rule? Book a free Microsoft 365 security assessment and we will sweep your mailboxes for suspicious rules and forwarding.
Malicious inbox rules in Microsoft 365 are one of the quietest tools an attacker has. They need no malware, they survive a password reset, and the mailbox owner almost never notices them. A rule that moves every reply about an invoice into an obscure folder can hide a fraud for weeks.
This article explains how attackers use inbox rules, what the suspicious ones look like, how to find them across your whole tenant, and how to stop them coming back.
Why attackers love inbox rules
An inbox rule is a normal Outlook feature: “when a message arrives that matches X, do Y.” Users create them to file newsletters. Attackers create them for three reasons:
In the compromised mailboxes I investigate, a malicious inbox rule is one of the most common things left behind, and removing it is a step that gets missed when someone only resets the password.
Here is how it typically plays out. An attacker phishes the office manager’s password and signs in. Within minutes they create a rule: any message from the company’s main supplier, or containing the word “invoice”, is marked as read and moved to RSS Subscriptions. They then email accounts payable from the real mailbox with new bank details. When the supplier later replies to ask why they have not been paid, that reply goes straight into the hidden folder. The office manager sees nothing unusual. Weeks can pass before anyone connects the dots.
What a malicious rule usually looks like
Attackers want their rules to be invisible and forgettable. The same patterns show up again and again.
.,..,a, or a single spaceOne of these alone is not proof. A user really might file a supplier’s emails into Archive. Two or three together, especially with a meaningless name, deserve a closer look.
How to find malicious inbox rules
Check one mailbox
The quickest way is Exchange Online PowerShell. After connecting with
Connect-ExchangeOnline, run:Get-InboxRule -Mailbox user@yourdomain.com -IncludeHidden | Format-List Name,Enabled,DescriptionThe
-IncludeHiddenswitch matters. Some rules created through low-level mailbox APIs do not appear in Outlook or Outlook on the web, but PowerShell can still see them. TheDescriptionfield gives a readable summary of what each rule does.Check every mailbox
For a tenant-wide sweep, loop through mailboxes and export any rule that forwards, redirects, deletes, or moves to unusual folders. A simple approach:
Get-Mailbox -ResultSize Unlimited.Get-InboxRule -IncludeHidden.ForwardTo,ForwardAsAttachmentTo,RedirectTo, orDeleteMessageis set, or whereMoveToFolderpoints to RSS, Archive, or Conversation History.In a 100-mailbox tenant this takes minutes and is worth doing every quarter.
Check the audit log
In the Microsoft Purview portal, search the audit log for the operations
New-InboxRule,Set-InboxRule, andUpdateInboxRules. Look at the IP address and time of each event. A rule created from an unfamiliar country at 3 a.m., minutes after a suspicious sign-in, tells you a lot. This only works if audit logging was turned on before the incident.Watch the alerts
Microsoft Defender XDR raises alerts for suspicious inbox manipulation and suspicious forwarding. These are some of the most valuable alerts a small business can act on. Make sure they reach a person, not an unread mailbox.
Removing a malicious rule properly
If you find a malicious rule, treat the account as compromised. Removing the rule alone leaves the door open.
Remove-InboxRule, or disable it first withDisable-InboxRuleif you need to preserve it.Preventing the damage in the first place
You cannot stop users from creating inbox rules, and you would not want to. You can make malicious ones far less useful.
Our managed security service monitors for suspicious rule creation and responds the same day. A Microsoft 365 security assessment includes a full inbox rule and forwarding sweep, and MFA enablement closes the most common way in. Microsoft lists suspicious inbox rules among the key symptoms in its guide to responding to a compromised email account.
Frequently asked questions
Does changing the password remove malicious inbox rules?
No. Inbox rules are stored in the mailbox and keep running after a password reset. You have to find and remove them separately, which is why they are such an effective persistence trick.
Why can I not see the rule in Outlook?
Some rules are created in ways that hide them from Outlook and Outlook on the web. Use
Get-InboxRulewith the-IncludeHiddenswitch in Exchange Online PowerShell to see every rule on the mailbox.Should we block users from creating inbox rules?
Usually not. Rules are useful for staff. It is more practical to block external forwarding, monitor for suspicious rule creation, and review rules regularly.
Worried a mailbox in your tenant has a hidden rule? Book a free Microsoft 365 security assessment and we will sweep your mailboxes for suspicious rules and forwarding.