How can I tell whether there is a suspicious forwarding rule in my mailbox?

In Outlook on the web open Settings, Mail, Rules, or in Outlook for Windows go to File, Manage Rules & Alerts. Also check Settings, Mail, Forwarding. A rule you did not create yourself, that sends mail outside or deletes messages, is suspicious.

Does an inbox rule disappear when I change my password?

No. A rule keeps working after the password is changed. That is why after a compromised account you should always check the rules, as well as changing the password and signing out all sessions.

Does blocking automatic forwarding protect against these rules?

Partly. It blocks forwarding to external addresses, but not rules that move or delete mail or forward to an internal address. That is why you also need to check the rules themselves.

Should I delete a suspicious rule straight away?

No. First record what the rule does, where it sends mail and since when. Then disable it. With those details you can work out which mail has leaked and whether you need to report a data breach.

Mailbox rules that steal mail: how an SME should find suspicious forwarding rules

A customer calls: he paid the invoice three weeks ago, to the new bank account from your email. You never sent a new bank account, and you never received his questions about it either. In many cases like this, an inbox rule that someone else created in your mailbox is behind it.

Why an attacker creates an inbox rule

Someone who takes over a mailbox through phishing rarely just wants to look around. The goal is often money: taking over an ongoing conversation about an invoice, getting a bank account changed, or resetting passwords for other services. To do that, the attacker needs to read along without the real user noticing. An inbox rule is the simplest way. It is a normal Outlook feature, needs no special software, and keeps working after the password has been changed.

Typical rules do one of these things:

Forward mail containing certain words, such as invoice, payment, IBAN, bank or password, to an external address.
Move replies from one particular customer or supplier straight into a folder the user never opens, such as RSS Feeds, Archive or Conversation History.
Delete notifications from, for example, Microsoft, the bank or a password reset as soon as they arrive.
Forward all mail and then delete it, so the user only sees what the attacker leaves behind.

How this differs from blocking automatic forwarding

In an earlier article we showed how to block automatic forwarding to external addresses for the whole organisation. That is an important measure and it stops many forwarding rules. But a rule that moves or deletes mail is not covered by it. An attacker can still cover their tracks and intercept your customer’s replies while running the fraud from your own mailbox. Rules that forward to an internal address, such as another compromised account, are not stopped either. Blocking forwarding and checking inbox rules work together.

How to check the rules of one mailbox

Outlook for Windows. Go to File, Manage Rules & Alerts. You see the rules of your own mailbox here. Select a rule to read at the bottom exactly what it does.
New Outlook and Outlook on the web. Go to Settings, Mail, Rules. This is often the clearest view, also if you work on a Mac or phone.
Mailbox-level forwarding. In Outlook on the web, also check Settings, Mail, Forwarding. As an admin you can see per mailbox in the Exchange admin center whether a forwarding address has been set. That is a different setting from an inbox rule, but attackers use it too.

Keep in mind that some rules can technically be created in a way that hides them from Outlook. Checking in Outlook is a good start, but not a guarantee.

Checking every mailbox at once with PowerShell

As an admin you can use Exchange Online PowerShell to fetch every rule from every mailbox in one go. Get-InboxRule -Mailbox [email protected] shows the rules for one user; a short loop over all mailboxes gives you an overview of the whole company. Pay particular attention to the ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage and MoveToFolder fields. The -IncludeHidden option also returns rules that stay hidden in Outlook. Include the shared mailboxes, such as info@ or invoices@: nobody tends to look at their rules, yet sensitive mail arrives there.

The audit log also records when a rule was created or changed and from which IP address. That helps you establish since when mail has been leaking.

Red flags

Forwarding to an external address, especially a free email address or one that resembles a customer or colleague.
A rule that forwards and then deletes the message or marks it as read.
Odd or empty names: a dot, two dots, a single letter or a random string.
Rules that move mail into rarely used folders such as RSS Feeds or Conversation History.
Conditions with words like invoice, payment, bank account, password or the name of one specific customer.
A rule the user does not recognise, or one created at a time they were not working.
Rules on shared mailboxes, or on mailboxes of former staff that are still active.

What to do if you find a suspicious rule

Do not delete the rule straight away. First take a screenshot or export the details: what the rule does, to which address, since when. You need that information to work out which mail has leaked. Then disable the rule and treat the account as taken over: change the password, sign the user out everywhere, check whether the attacker added their own MFA method and see whether any apps were granted access. Review the sent items and the audit log to see who the attacker emailed. Warn customers or suppliers who may have received a fake payment request, and assess whether personal data has leaked that you need to report to the data protection authority. If so, under the GDPR that generally has to happen within 72 hours. An IT incident plan makes these steps much calmer.

Then check the other mailboxes too. An attacker who has taken over one account often sends phishing to colleagues from it. An external email warning banner helps staff spot fake messages from outside more quickly.

What Floor ICT does

Floor ICT sets up Microsoft 365 for clients so that an alert is raised when someone creates an inbox rule that forwards outside the organisation or deletes messages, and blocks automatic forwarding to external addresses at organisation level. We regularly review the rules of every mailbox, including shared mailboxes and former staff accounts, and discuss anything unusual with you. If we find a suspicious rule, we record the details, lock down the account and work out what has leaked and since when. As your MSP we do the technical work; who you inform and whether you report a data breach is your decision, based on the facts we provide.

View MSP packages Request an intake Microsoft 365