B BROCENT Get a quote

incident investigation

Cover image for Brocent IT blog post: Business Email Compromise Inbox Rules: How to Find Malicious Rules in Exchange Online After a Suspected BEC

November 03, 2026 | 10 min

Business Email Compromise Inbox Rules: How to Find Malicious Rules in Exchange Online After a Suspected BEC

After a suspected business email compromise, check inbox rules first: the patterns attackers use, where to find them in Exchange Online, and what to keep.