Business Email Compromise Inbox Rules: How to Find Malicious Rules in Exchange Online After a Suspected BEC

The short version: After a suspected business email compromise, inbox rules are the first thing to check, because they are how an attacker stays hidden inside a mailbox: moving replies about payments out of sight, deleting warnings, or forwarding copies out. List every rule on the mailbox, including hidden ones, then use the Microsoft Purview audit log to see who created each one, when and from where. Contain the account first, preserve the evidence second, and only then delete anything.

Business email compromise rarely looks like a break-in. Someone in finance receives an email from a supplier they know, with a new bank account for this month's invoice. The email comes from the supplier's real mailbox, or from yours, because an attacker has been reading it for weeks. What keeps the attacker hidden during those weeks is very often a small set of business email compromise inbox rules: rules that move the real supplier's replies to a folder nobody opens, so the fraud is not noticed until the payment has gone.

This article is about investigation: the rule patterns attackers use, where to find them in Exchange Online, which audit records show who made them, and what to keep before you clean up. Preventing forwarding in the first place is covered in our companion guide on blocking Microsoft 365 external email forwarding.

One point before anything else. If you believe a mailbox is compromised right now, contain it before you investigate it: reset the password, revoke the user's sessions, and check the registered sign-in methods. The steps are below. If you need help doing that, contact us and say it is urgent.

Why do attackers create inbox rules?

An attacker who controls a mailbox has two problems. The real owner will notice replies to emails they did not send, and security warnings or bounce messages may give the game away. Inbox rules solve both problems quietly, and they keep working even after the password is changed, because a rule belongs to the mailbox, not to the session.

The patterns reported again and again in public incident write-ups, including Microsoft's own security research on business email compromise, fall into a few groups.

• Hide the conversation. Messages from a particular supplier, customer or finance contact, or containing words such as invoice, payment, bank, wire, remittance or the supplier's name, are moved to a folder the user never looks at: RSS Subscriptions, RSS Feeds, Conversation History, Archive, or a newly created folder with an innocent name.
• Mark it as read. Combined with the move, so nothing appears unread.
• Delete the warnings. Messages containing words like "phishing", "hacked", "suspicious" or "did you send", or bounce messages, are deleted on arrival so the user never sees a colleague's warning.
• Copy it out. Forward, forward as attachment or redirect to an external address, often narrowly, for example only messages from the finance director.
• Look unremarkable. Rule names that are a single character, a dot, a few repeated letters, or a copy of an existing rule's name.

None of these is proof on its own. Staff create odd rules all the time. What matters is the combination: a narrow financial keyword, a move to a folder nobody uses, a creation date close to a suspicious sign-in, and a user who does not recognise it.

Where do you find inbox rules in Exchange Online?

Start with the mailbox you suspect, then widen to every mailbox the same attacker might have reached.

Outlook on the web and the Outlook client

The user's own view is in Outlook on the web under Settings, Mail, Rules. It is a quick first look, but it is not complete. Some rules created through other interfaces are not shown in every client, and an attacker may have created a rule the user's Outlook cannot display properly.

Exchange Online PowerShell

The authoritative list comes from PowerShell. Get-InboxRule -Mailbox user@yourdomain.com lists the rules; adding -IncludeHidden also returns hidden rules, which is where some attacker-created rules sit. Pipe the result to Format-List and look at Name, Enabled, Description, From, SubjectContainsWords, BodyContainsWords, MoveToFolder, MarkAsRead, DeleteMessage, ForwardTo, ForwardAsAttachmentTo and RedirectTo. The Description property is useful because it states the rule in plain English.

While you are there, check the other places an attacker can hide copies: the mailbox forwarding properties (ForwardingSmtpAddress and ForwardingAddress on Get-Mailbox), mailbox delegates and folder permissions (Get-MailboxPermission and Get-MailboxFolderPermission), and any mail flow rule that touches this mailbox.

Across the whole tenant

If one mailbox was compromised, assume others were tried. Run Get-InboxRule against every mailbox and filter for rules that forward, redirect or delete, or that move mail to RSS Subscriptions, Conversation History or Archive. Sort by the rule's apparent creation time and compare against the timeline of the first compromised account. The forwarding inventory in our external forwarding guide uses the same queries.

What do the audit logs tell you?

The rules tell you what was done. The audit log tells you who did it, when and from where, which is what you need to separate an attacker's rule from a user's own.

Rule creation and changes

Microsoft Purview's audit search, in the Purview portal under Audit, records inbox rule activity. The operations to search are New-InboxRule and Set-InboxRule, for rules created or changed in Outlook on the web or through PowerShell, UpdateInboxRules, for rules created, changed or removed from the Outlook desktop client, and Remove-InboxRule. In PowerShell the same search is Search-UnifiedAuditLog with -StartDate, -EndDate, -UserIds and -Operations set to those names. Microsoft's article "Use the audit log to identify Exchange inbox rules activities" explains that the record's Parameters field shows the rule's conditions and actions, and its client IP shows where the change was made from.

Sign-ins around the same time

In the Microsoft Entra admin center, open the user's sign-in logs for the days around the rule's creation. Look for sign-ins from countries or networks the user does not use, unfamiliar browsers or devices, and sign-ins that succeeded with MFA from a location the user was not in. That last one matters. Adversary-in-the-middle phishing pages can capture a session after the user completes MFA, so "MFA was on" does not rule out a compromise. Our guide on how to enable MFA in Microsoft 365 covers why phishing-resistant methods close that gap.

What the attacker read and sent

Message trace, in the Exchange admin center under Mail flow, shows what the mailbox sent and received in the period, including messages that were deleted or moved. Where the licence records it, the MailItemsAccessed audit event shows which messages were opened, which helps you judge what data was exposed. Check what your licence actually logs rather than assuming.

How long the evidence lasts

This is the part people discover too late. Microsoft documents that Audit (Standard) keeps records for 180 days for logs created on or after 17 October 2023; longer retention needs Audit (Premium) or a retention policy. If the compromise may have started months ago, export the relevant records now.

Contain, preserve, then clean up

The order matters. Cleaning up first destroys the evidence you need to work out how far the attacker got and to support any insurance claim, bank recall or legal step.

1. Contain. Reset the user's password, then revoke their sessions in the Microsoft Entra admin center so existing sign-ins are signed out. Review the user's registered authentication methods and remove any the user did not add; attackers often register their own authenticator. Check for app consents the user did not grant.
2. Disable, do not delete, the suspicious rules. Set-InboxRule with -Enabled $false stops a rule without destroying it, so its full definition is still there to export.
3. Preserve. Export the Get-InboxRule output, the relevant audit log records, the sign-in log entries and the message trace for the period. Record the time and who did each step. If legal action, an insurance claim or a regulator notification is likely, speak to your legal adviser and insurer before deleting anything; they may ask for a hold on the mailbox.
4. Warn the people who matter. Tell finance, and tell the suppliers or customers whose conversations were targeted, through a phone number you already hold, not one in an email.
5. Clean up. Remove the malicious rules, forwarding addresses, delegates and app consents. Then check other mailboxes for the same pattern.
6. Close the door. Find how the attacker got in, usually a phishing page or a reused password, and fix that, not just the symptoms.

Built-in alerts, manual review or continuous monitoring?

Three ways an organisation finds out about a malicious rule, and what each can and cannot do.

Which approach catches a malicious rule soonest?

• Built-in alert policies. Microsoft Defender includes default alert policies for the creation of forwarding or redirect rules and for suspicious forwarding activity, and Microsoft Defender for Cloud Apps can flag suspicious inbox manipulation. Several come with standard Microsoft 365 business licences, while Defender for Cloud Apps needs its own licence. Their limit is that someone has to read the alert, and rules that only move or delete mail may not trigger a forwarding alert at all.
• A periodic manual review. Running the tenant-wide Get-InboxRule query monthly or quarterly catches rules that alerts miss, including move-and-delete rules. Its limit is time: a rule created the day after a review runs for weeks.
• Continuous monitoring by a security operations centre. Analysts watch sign-in risk, rule creation and mailbox activity together, and act within hours. This is what a security operations centre service provides, and it is the option that fits organisations where a single fraudulent payment would be serious.

What does a Microsoft 365 security audit check here?

An audit is not an incident response. It is the review you do before an incident, or after one has been contained, to find the weaknesses that made it possible. In Brocent's Microsoft 365 security audit, the email-security area checks inbox rules that forward, redirect or delete across every mailbox, mailbox forwarding, the outbound forwarding policy, the state of the related alert policies, mailbox auditing and audit retention, and the MFA and Conditional Access settings that would have stopped the sign-in in the first place.

The Microsoft 365 security audit sample report shows how these findings are written up and ranked. The audit is read-only and remote, with the report delivered within 5 to 7 business days after read-only access is granted and the debrief booked in your business hours, whether you are in the UK, Australia or Asia. Pricing is fixed by headcount, from US$450 for up to 10 users; see the Microsoft 365 security audit pricing page for the bands and scope.

The Hong Kong supplier payment fraud case shows what this kind of compromise looks like from the finance team's side. For UK firms, a compromised mailbox holding personal data can also raise data protection questions, and for many firms it is a cyber-insurance matter; in both cases the audit report is designed to be used as evidence of the controls in place, not as a legal opinion.

Frequently asked questions

Which inbox rules are most suspicious after a BEC?

Rules that move mail containing payment or supplier keywords to RSS Subscriptions, Conversation History, Archive or a new folder; rules that delete messages mentioning phishing or hacking; rules that forward or redirect externally; and rules with meaningless names such as a single dot.

Will changing the password remove the attacker's rules?

No. Inbox rules belong to the mailbox and keep running after a password reset. You must also revoke sessions, review sign-in methods and remove the rules themselves.

How do I see who created an inbox rule?

Search the Microsoft Purview audit log for New-InboxRule, Set-InboxRule and UpdateInboxRules on that mailbox. The record shows the account, the time, the client IP and, in its Parameters field, the rule's conditions and actions.

Why can't I see the rule in Outlook?

Some rules are hidden from certain clients. Use Get-InboxRule with -IncludeHidden in Exchange Online PowerShell to see the full list.

How far back can we investigate?

With Audit (Standard), Microsoft retains audit records for 180 days for logs created on or after 17 October 2023. Longer retention needs Audit (Premium) or a retention policy, so export what you need early.

Does Brocent provide incident response?

Brocent does not offer an incident-response retainer. If you suspect an active compromise, contain the account first using the steps above, and contact us for help with containment, clean-up and the follow-up review.

Should we delete the malicious rule straight away?

Disable it first and export its details, together with the audit and sign-in records. Delete it once the evidence is preserved.

Where to start

If you have no reason to suspect a compromise today, run the tenant-wide inbox rule query this week and look for the patterns above. If you find a rule nobody can explain, treat it as an incident and follow the containment steps. If you would like an independent review of the controls around it, the audit pricing page sets out the scope, or you can talk to a consultant.