Use Case: Email
Malicious mailbox rule detection
An inbox rule silently forwarded all incoming email to an external Gmail address for 3 weeks. The CFO's account was compromised. The attacker watched every finance conversation before making their move.
The silent wiretap inside your email
After compromising an email account — via phishing, credential stuffing, or AiTM proxy — a sophisticated attacker's first action is often creating an inbox rule that forwards all email to an external address they control. This rule is invisible to the account owner (it appears in the settings menu they rarely check) and gives the attacker a continuous feed of all incoming communications without needing to maintain active access to the account.
From a detection perspective, the challenge is that inbox rules are a legitimate feature. Detecting malicious rules requires evaluating the destination, the rule condition, and the context of when the rule was created relative to other account events.
rule: malicious_mailbox_rule
type: event + destination_check
sources:
- microsoft_365_unified_audit (New-InboxRule, Set-InboxRule)
- google_workspace_admin_sdk
trigger:
- event: mailbox_rule.created OR mailbox_rule.modified
- condition: |
rule.action.forward_to.domain NOT IN company_domains
OR rule.action.delete == true AND rule.conditions.subject_keywords.intersect(security_keywords)
OR rule.created_at WITHIN 1h OF new_ip_login
enrichments:
- destination_domain: reputation, registration_date
- account_compromise_context: recent_suspicious_auth
- rule_scope: all_email vs specific_subjects
mitre: T1114.003 (Email Collection: Email Forwarding Rule)MITRE ATT&CK mapping
Mailbox rule abuse FAQ
Are mailbox forwarding rules always malicious?
No. Legitimate use cases include forwarding to a shared mailbox, an assistant, or an external personal address during a vacation. ManySignal checks the forwarding destination against a known-good list (company domains, registered personal email in HR records) and flags rules that forward to external domains not previously associated with the account owner.
What's the typical purpose of a malicious mailbox rule in a BEC attack?
BEC attackers create forwarding rules to silently monitor email communications — watching for financial transaction discussions, vendor relationships, and wire transfer approvals. They then time their fraudulent payment request to coincide with a legitimate pending transaction, making the request appear credible.
Does ManySignal detect rules that delete or move emails rather than forward them?
Yes. Rules that delete emails matching specific keywords (security alert, MFA notification, suspicious login) are a defense evasion technique — the attacker moves security notifications to trash so the legitimate user doesn't see warnings about their compromised account. These deletion rules are flagged with higher severity than forwarding rules.
How does ManySignal access mailbox rule data?
Via the Microsoft Exchange Online PowerShell API and Microsoft Graph (Get-InboxRule), and the Google Workspace Admin SDK (users.settings.filters). ManySignal continuously polls for new rule creation events and correlates with the Unified Audit Log's New-InboxRule event for Microsoft 365.
Catch silent email forwarding rules before they drain your inbox intelligence
Real-time mailbox rule monitoring for M365 and Google Workspace — correlated with account compromise signals.