The attacker who beats your MFA doesn't smash and grab. They set up a quiet inbox rule so you never see the replies. Malicious inbox rules and auto-forwarding are the classic Business Email Compromise (BEC) channel for exfiltration and persistence, and they hide in plain sight in Exchange Online. Here are the six patterns that show up in nearly every compromised mailbox we investigate.
Key takeaway: after MFA is bypassed, malicious inbox rules and external auto-forwarding are the first thing attackers set up in Microsoft 365, and reviewing them should be routine hygiene, not a post-incident scramble.
1. Delete-and-Hide Rules
The rule marks incoming mail as read and moves it to a folder nobody opens: RSS Feeds, Conversation History, or straight to Deleted Items. Now the victim never sees their own fraud alerts or the confused replies to a spoofed invoice. We've seen a plain "delete all" rule quietly bury an entire wire-fraud conversation while the attacker ran the con from the outside. Any rule that deletes or reroutes based on nothing specific deserves a hard look.
2. External Auto-Forwarding
A copy of every message gets pushed to an outside domain. This lives in two places, and that matters. Inbox rules with a forward action are easy to spot. The mailbox-level setting, Set-Mailbox -ForwardingSmtpAddress, is the blind spot: it sits outside the rules collection entirely, and plenty of tools never check it. If you only audit inbox rules, you miss half the problem. Pull both.
3. Keyword-Triggered Forwarding
The rule only fires on words like invoice, payment, wire, ACH, remittance, or password. This is targeting, not noise. The attacker isn't interested in your lunch plans, they want the financial thread and the credential reset emails. It is often the payload of an AiTM phishing campaign, where stolen session cookies hand over the mailbox in the first place. A forwarding rule keyed to money and auth vocabulary is one of the cleanest BEC indicators there is. Treat it as an active incident.
4. Conversation-Hiding Rules
A rule moves one specific sender or thread out of the inbox, usually to keep the victim blind while a wire-fraud conversation plays out with a supplier or the finance team. It looks almost like normal inbox organization, which is exactly the point. When you find a rule scoped to a single external counterparty during an active payment discussion, you've likely found the compromise.
5. stopProcessingRules Abuse
Exchange rules can carry a flag that halts processing of every rule after them. Attackers use it to leapfrog the org's own security and alerting rules, suppressing the automation you rely on to catch bad mail. A newly created rule with stopProcessingRules set, sitting ahead of your defensive rules, is a strong tampering signal. Check the order, not just the actions.
6. Tenant-Wide vs Mailbox-Level Forwarding Drift
This is the one that catches teams who think forwarding is locked down. The tenant RemoteDomain AutoForwardingMode controls whether individual mailboxes can forward externally at all. If it's left permissive, a single mailbox can silently ship mail to the outside world even when your policy says external forwarding is blocked. The mailbox setting and the tenant setting have to agree. When they drift, the gap is invisible until someone abuses it.
Why It Keeps Happening
Once MFA is bypassed through token theft or AiTM phishing, mail-rule persistence is usually the first move a competent attacker makes. It survives password resets, it's quiet, and it rides in on the same stolen session that skips your Conditional Access policies. Most teams never look at inbox rules until they're already writing an incident report. This is exactly the kind of pattern SecValley's Microsoft 365 scanner surfaces automatically, so drift and suspicious rules turn up in a report instead of a breach.
Frequently Asked Questions
How do attackers use inbox rules in a mailbox compromise?
After stealing a session or password, attackers create rules that delete, hide, or forward mail so the victim never sees fraud alerts or replies. It gives them quiet persistence and an exfiltration channel that survives a password reset. That is why inbox rules are a signature move in Business Email Compromise.
How do I detect malicious auto-forwarding in Microsoft 365?
Audit both layers: inbox rules with a forward action, and the mailbox-level ForwardingSmtpAddress setting that many tools miss. Also check the tenant RemoteDomain AutoForwardingMode, since a permissive tenant setting lets individual mailboxes forward externally even when you think it is blocked.
Does MFA stop inbox rule attacks?
No. MFA protects the sign-in, but token theft and non-interactive sign-ins let attackers reuse a stolen session without prompting for MFA again. Once inside, they create inbox rules directly, so mailbox rule review has to be a standing control on top of MFA.
Reviewing inbox rules and forwarding config should be a standing hygiene check, not a post-incident scramble. Put it on the calendar, or let a scanner watch it for you.
