Detecting Malicious Mailbox Rules and Hidden Forwarders in Microsoft 365
How attackers hide inside inboxes using hidden server-side rules and how to hunt for them using PowerShell and Sentinel queries.
The Attacker's First Move After Mailbox Breach
Upon compromising a corporate mailbox, attackers immediately create client-side or server-side inbox rules with criteria such as: 'Move messages containing "invoice", "wire", or "bank" to RSS Feeds or Deleted Items'.
Hunting for Obfuscated Rule Names
Attackers often name rules '.' or ' ' or use high Unicode characters to make them invisible in the standard Outlook desktop client interface.
PowerShell Scripting for Tenant-Wide Detection
Run automated daily scripts using `Get-InboxRule` and `Get-Mailbox` to flag any forwarding addresses pointing to external domains and identify rules that delete or hide incoming correspondence.
Related Articles & Advisories
SPF, DKIM & DMARC: Stopping Domain Spoofing and Executive Impersonation
Why traditional spam filters fail against spoofed domains, and how enforcing DMARC p=reject stops attackers from impersonating your executive team and company brand.
The Road to DMARC Enforcement: Migrating from p=none to p=reject Safely
A phased methodology for cataloging third-party senders, aligning cryptographic keys, and enforcing zero-tolerance rejection without dropping legitimate mail.
Business Email Compromise (BEC): Anatomy of Invoice Redirection Wire Fraud
How cybercriminals intercept supplier email threads, manipulate banking details, and siphon millions through synthetic invoice redirection.