Hidden inbox rules: the quickest way to spot a compromised Microsoft 365 account

A lot of businesses still think Microsoft looks after their cyber security. It doesn’t, not really. Microsoft keeps the service running. Who can get into your mailboxes, and what they do once they are in, is down to you and whoever runs your IT.

When an attacker gets into a mailbox, one of the first things they do is set up an inbox rule. It forwards copies of email to an outside address, or moves replies into a folder nobody looks at, such as RSS Feeds or Junk Email. The person whose account it is carries on working and notices nothing. Some attackers go a step further and hide the rule, so it doesn’t appear in Outlook or in the Microsoft 365 admin centre either.

Why does a hidden inbox rule matter to the business?

Because the rule keeps working after you think the problem is fixed. Resetting the password locks the attacker out of signing in, but a forwarding rule they left behind keeps sending them your email. They can see which customers owe you money, which suppliers you pay and when. That is everything they need to send a fake “our bank details have changed” email that looks like it came from you or from one of your suppliers.

The damage isn’t only the money. Once they have your email, attackers can contact your customers and suppliers, tell them your business has been breached and ask to be paid to keep quiet. Reputation, contracts and insurance renewals are all on the line, which makes this a decision for the owners and directors, not just a job for IT.

Understanding Hidden Inbox Rules In Microsoft 365

An inbox rule is the normal Outlook feature that files email for you, for example “move everything from the accounts system into the Invoices folder”. Attackers use exactly the same feature. The difference with a hidden rule is that it has been edited underneath Outlook so the usual screens don’t list it, even though Exchange Online is still running it on every message.

The Attack Vector: Abusing Outlook Client Features

Rules created in the Outlook desktop app are stored in the mailbox itself. Underneath the rules wizard, each rule is a set of MAPI properties (MAPI is the lower-level way Outlook talks to Exchange). With a tool that can edit those properties directly, an attacker who already has access to the mailbox can change a rule so that Outlook and the standard admin tools no longer show it, while the rule keeps processing email.

Persistence Through Undetected Mailbox Modifications

This is why attackers bother. The hidden rule does their work for them: forwarding messages out, deleting the replies that would give them away, or moving them to a folder the user never opens. They don’t need to keep signing in, so there may be no suspicious sign-ins to spot, but your email is still going astray.

Impact on Microsoft 365 Security Investigations

Anyone investigating a breach who only checks the Exchange admin centre or Outlook can miss the rule completely and close the incident too early. Microsoft doesn’t treat hidden rules as a security flaw, because the attacker needs access to the mailbox first. That is true, but it means the clean-up is your job.

Detecting Compromised Microsoft 365 Accounts

These are the signs an owner or office manager can spot without any technical tools. If you see any of them, treat the account as compromised until your IT team says otherwise.

Common Indicators of Compromised Mailboxes

• The mailbox is blocked from sending email. Microsoft does this when an account suddenly sends a large volume of messages.
• Customers or suppliers ask about an email you didn’t send, often a payment request or a “shared document” link.
• Emails are missing, or replies you were expecting never arrive.
• Messages in Sent or Deleted Items that the user doesn’t recognise.
• New forwarding to an outside address that nobody set up.
• Sign-in alerts from places or devices the user doesn’t recognise.
• Security settings changed: MFA removed, a new phone number or recovery address added.

Symptoms Beyond Suspicious Inbox Rules

Attackers often add their own app to the account (an OAuth app, the kind of thing that asks “allow this app to read your mail?”). That gives them a way back in that survives a password reset. They may also have opened files in SharePoint or OneDrive while they were in, which matters for working out what data has gone.

The Challenge of Hidden Rule Visibility

Rules created in the Outlook desktop app live in the mailbox, not in the admin portal, and hidden ones don’t appear in either place. Checking Outlook’s Rules screen is still worth doing, because most malicious rules aren’t hidden, but an empty list doesn’t prove the mailbox is clean.

What to do now if you think an account has been hacked

This is the order we work in at GoodChoice IT. It’s quite technical, so if you don’t have someone who does this regularly, ask for help early.

1. Warn the people who received the suspicious email not to click it or pay anything. Do this first.
2. Sign in to the admin centre with a separate admin account, not the account you use every day.
3. Sign the user out of all sessions, then reset their password.
4. Check for new inbox rules and forwarding, including hidden rules (the steps for your IT team are below).
5. Check the list of apps with access to your Microsoft 365 and remove anything nobody recognises.
6. Look at the SharePoint and OneDrive logs to see which documents were opened.
7. Screenshot anything odd on the user’s computer and run a malware scan on it.

Investigating Suspicious Inbox Rule Activity

This section is for your IT team or IT provider.

Limitations of Standard Administration Tools

Plain Get-InboxRule -Mailbox [email protected] and the Exchange admin centre list the rules a mailbox shows normally. A rule hidden by the attacker won’t be in that list.

Finding hidden rules with Get-InboxRule -IncludeHidden

Microsoft’s documentation for Get-InboxRule describes the -IncludeHidden switch as including hidden Inbox rules in the results, and it is available in Exchange Online. So the quickest check is to run the cmdlet twice, with and without the switch, and compare the two lists. Anything that only appears with -IncludeHidden is hidden.

Expect one hidden rule on almost every mailbox: Junk E-Mail Rule. That’s Outlook’s own junk filter and it is meant to be hidden, so the scripts below leave it alone.

The Role of MAPI Editors in Detection

MFCMapi opens the mailbox’s own storage, where every rule lives, so it shows rules whatever their visibility. It’s slower than PowerShell and works one mailbox at a time, so use it when you need to be certain about a particular mailbox, or when PowerShell shows nothing but the symptoms say otherwise.

Here’s how each kind of rule shows up:

The Graph Activity Log can also show unusual mailbox access during an investigation, even where the rule itself was hidden.

Remediation Strategies for Hidden Rules

Removing the rule is only part of the fix. If the attacker still has a session, an app or a forwarding address, they will put it back, so do the steps in “What to do now” first.

PowerShell Commands for Rule Removal

Connect to Exchange Online PowerShell, replace [email protected] with the mailbox, and run this to list the hidden rules first. Read them before you delete anything: the rule’s conditions and forwarding address are evidence.

$mailbox = "[email protected]"
$visible = (Get-InboxRule -Mailbox $mailbox).Name
$hiddenrules = Get-InboxRule -Mailbox $mailbox -IncludeHidden | Where-Object { $_.Name -notin $visible -and $_.Name -ne "Junk E-Mail Rule" }
$hiddenrules | Format-List Name, Description, Enabled, ForwardTo, RedirectTo, MoveToFolder, DeleteMessage

# When you're happy they're malicious, remove them:
Foreach ($rule in $hiddenrules) {
  Write-Host "Removing rule - $($rule.Name)"
  Remove-InboxRule -Identity $rule.Identity -Mailbox $mailbox -Confirm:$false
}

The ‘Outlook.exe /cleanrules’ Mitigation

Starting Outlook with the /cleanrules switch removes all rules on the mailbox, visible and hidden. It’s quick, but the user loses their legitimate rules too and will need to set them up again.

1. Close Outlook completely.
2. Press Windows key + R to open Run.
3. Type outlook.exe /cleanrules and press Enter.
4. Recreate any genuine rules the user needs.

It suits a single user you can work with directly, not a clean-up across the whole business.

Scalable Tenant-Wide Rule Eradication

If more than one account may be affected, check every mailbox. This lists hidden rules across the tenant so you can review them before removing anything:

$report = Foreach ($mbx in Get-EXOMailbox -ResultSize Unlimited) {
  $upn = $mbx.UserPrincipalName
  $visible = (Get-InboxRule -Mailbox $upn).Name
  Get-InboxRule -Mailbox $upn -IncludeHidden |
    Where-Object { $_.Name -notin $visible -and $_.Name -ne "Junk E-Mail Rule" } |
    Select-Object @{n="Mailbox";e={$upn}}, Name, Identity, ForwardTo, RedirectTo, MoveToFolder, DeleteMessage
}
$report | Format-Table -AutoSize

# After review, remove them:
# $report | ForEach-Object { Remove-InboxRule -Identity $_.Identity -Mailbox $_.Mailbox -Confirm:$false }

Forensic Analysis of Compromised Accounts

Beyond Credential Resets: Deeper Investigation

A password reset on its own leaves the back doors open. Check for forwarding set on the mailbox itself as well as in rules, apps granted access to mail or files, and anything the attacker sent or deleted while they were in.

Identifying the Root Cause of Compromise

Work out how they got in, or it will happen again. The sign-in logs show where and when the account was used: a run of failed attempts followed by a success points to password guessing, while a single clean sign-in from abroad usually means the password or session was stolen by a phishing page. Check the user’s computer for malware too.

Assessing the Scope of Tenant Impact

Attackers rarely stop at one mailbox. Once they have one account they use it to phish colleagues, because an email from someone you work with gets opened. Run the tenant-wide check above and review sign-ins for every user, not just the one who reported it.

Proactive Defence Against Mailbox Tampering

Securing User Credentials Effectively

• Multi-factor authentication on every account. It’s the minimum, not the whole answer: attackers now have ways around some kinds of MFA, which is why the checks below matter too.
• Long, unique passwords, kept in a password manager.
• Don’t force regular password changes. The NCSC’s guidance is that regular password expiry harms security, because people just add a number to the old one. Cyber Essentials doesn’t require it either. Change a password when you know or suspect it has been lost or stolen, and turn on Microsoft 365’s check that stops people choosing known weak passwords. More on this in our guide to passwords and sharing them safely.
• Watch sign-ins. Someone signing in from Chicago and Edinburgh five minutes apart isn’t one person.

Monitoring for Anomalous Application Permissions

Stop staff granting apps access to company email and files on their own. Require an administrator to approve app consent, and review the apps that already have access. A malicious app with mail permissions can read email and create rules without anyone signing in.

Educating Users on Phishing Threats

Most of these break-ins start with someone typing their password into a fake sign-in page. Short monthly training and regular test phishing emails work: staff who have had it question odd requests, staff who haven’t hand over their details. It isn’t about catching people out.

How GoodChoice IT helps

For the businesses we look after, Microsoft 365 is locked down and checked every 3 hours against our security checklist, with instant alerts to our team for suspicious sign-ins or unexpected changes. If an account has already been hacked, we can run the checks in this article for you, clean up the mailbox and tenant, then harden it so it doesn’t keep happening. For a quick outside view of how well your email domain is set up, try Dave’s free checker at securemyemails.com.

Think one of your accounts has been hacked, or want to know whether yours would be spotted? Contact GoodChoice IT or call 020 8099 5540 and we’ll talk you through it.

Frequently Asked Questions

Last reviewed: 12 October 2026.