Malicious Inbox Rules and Mail Forwarding in Microsoft 365: Detect and Block (2026)

Once a criminal has a valid session, the goal is to stay invisible and keep collecting. An inbox rule does both. A typical rule forwards anything mentioning "invoice," "payment," or "wire" to a free email account, then moves the original into the RSS Feeds or Archive folder, or marks it read, so the real user never notices. Other rules delete security alerts and bounce-backs so the victim never learns something is wrong. This is a common step in business email compromise, and it works because the rule survives a password change. Resetting the password closes the door but leaves the tap on the pipe.

There are several places a persistent forward can hide, and a quick check of only one is how businesses get reinfected:

• User inbox rules that forward, redirect, or delete messages based on keywords, senders, or subjects.
• Mailbox-level forwarding set through the mailbox properties, which can copy every message to an external address.
• Transport rules created by an administrator account, which apply across the tenant and are easy to overlook.
• Connected applications that were granted mailbox access, so the attacker keeps reading mail without ever using the password again.

Look for rules with odd or blank names, a single punctuation mark as a name, or conditions that match financial words. Any rule that forwards to an address outside your domain deserves immediate scrutiny, as does any rule that deletes mail or moves it to a rarely used folder. Check the audit log for rule creation events, and compare the time of creation against unusual sign-ins, such as logins from a country where you have no staff or from a device nobody recognizes. Tying these signals together is the job of identity threat detection and response, which is far cheaper than discovering the problem when a vendor calls about a payment that went to the wrong account.

You do not have to rely on catching every rule by hand. Several settings stop most of the damage at the tenant level:

1. Disable automatic external forwarding in the outbound spam policy so users cannot forward to outside addresses, and approve exceptions case by case.
2. Alert on new inbox rules that forward or delete, and on new transport rules, so a human reviews them the same day.
3. Restrict user consent for third-party apps so a stolen login cannot quietly authorize a mailbox-reading application.
4. Require strong sign-in controls with Entra conditional access policies so stolen credentials alone are not enough.

These steps line up with the broader Microsoft 365 security hardening checklist, and they are mostly configuration, not new spending.

Treat a malicious rule as proof of account takeover, not as a nuisance to delete. Work through the response in order so you do not leave a backdoor behind:

1. Revoke all active sessions and reset the password, then re-register multi-factor authentication on a trusted device.
2. Remove every suspicious inbox rule, mailbox forward, and any application the user does not recognize.
3. Search the audit log to learn which messages were forwarded and for how long, since that defines who may have been exposed.
4. Alert your finance team and any vendors involved in recent payment discussions to verify bank details by phone.
5. Preserve the logs and evidence, because insurers, clients, or counsel may ask for them later.

Your written incident response plan should already name who does each step, and the mailbox audit trail is also the kind of record covered in our Microsoft 365 eDiscovery guide if a dispute follows. Because attackers often arrive through stolen sessions, it is worth reading how infostealer malware and stolen session tokens bypass passwords entirely.

Start with two checks that take under an hour. First, disable automatic external forwarding in your tenant and confirm it with a test mailbox. Second, export every inbox rule and mailbox forward across your users and review anything that sends mail outside the company or deletes it. If the list is long or you find something unfamiliar, bring in a provider offering cybersecurity services to investigate and to set up continuous alerting, and pair it with managed IT services so the tenant settings stay locked down. You can also compare your controls with peers in the Texas SMB IT and cybersecurity benchmark.

• Cybersecurity services in Houston
• Cybersecurity services in The Woodlands
• Cybersecurity services in Sugar Land