Auditing mailbox rules and external forwarding after a suspected account compromise

Why rules matter

After taking over a mailbox, attackers often add inbox rules that move replies about invoices or security alerts to an obscure folder, or forward copies of all mail outside the organization. These rules let them keep watching and hide their activity even after the password is reset, so checking them is a standard incident step.

• Rules that move or delete messages containing invoice, payment, or security
• Forwarding to external addresses
• Rules with one-character or blank names
• Recently created rules on executive or finance mailboxes

Microsoft 365

Exchange Online PowerShell lists rules per mailbox and forwarding settings across the tenant. The unified audit log records New-InboxRule and Set-Mailbox operations with the source IP.

Connect-ExchangeOnline
Get-InboxRule -Mailbox a.rivera@example.org |
  Select Name, Enabled, From, SubjectOrBodyContainsWords, MoveToFolder, ForwardTo, RedirectTo, DeleteMessage
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward

Lab: audit a test tenant

In a developer or test tenant, create a test mailbox, add a rule that moves messages containing “invoice” to RSS Feeds, and set forwarding to an external test address. Then run the queries above to find both, search the audit log for the operations that created them, and remove them. In Google Workspace, review the same settings through the admin console’s email log search and the user’s forwarding settings.

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
  -Operations New-InboxRule,Set-InboxRule,Set-Mailbox -ResultSize 100 |
  Select CreationDate, UserIds, Operations, AuditData

Prevention

Block automatic forwarding to external domains with an outbound spam policy or transport rule, alert on new rules that forward externally or target security keywords, and include rule and forwarding review in every account compromise playbook.