Detect hidden inbox rules before Business Email Compromise costs you money
Zybim's Threat Detection Agent checks every mailbox in your Microsoft 365 tenant for hidden rules that silently forward or hide financial email. It alerts you in plain language so you can act before an attacker redirects a payment. Read-only. It never reads your email content.
Included in Monitoring Plus. Read-only, with a free assessment to start.
See pricing Check my domain for spoofing first (free)How Business Email Compromise really works
Most BEC attacks don't start with malware. An attacker steals one password, signs in, and creates an inbox rule. The rule forwards anything mentioning “invoice”, “payment” or “bank” to an outside address, or hides it in an obscure folder. The real user never sees the replies.
The attacker then waits for a real invoice and sends a near-identical one with new bank details. By the time anyone notices, the money is gone. The inbox rule is one of the earliest reliable signs, and it can sit unnoticed for weeks.
What the agent detects
- Rules that forward or redirect mail to addresses outside your organisation
- Rules that target financial keywords such as invoice, payment, bank, wire or remittance
- Rules that hide themselves: blank or punctuation-only names such as “.” or “..”, rules that stop other rules, delete messages or mark them as read
- The mailbox, the rule, where the mail is going, and when the rule was created
What you get when it finds something
A plain-language alert names the mailbox, the rule and where mail is going. It then lists the steps: remove the rule, reset the password, revoke sessions and check sent items. A human decides. The agent never changes your tenant.
The agent checks every mailbox about once a day, and each alert is time-stamped so there is a record of when it was raised and when it was fixed.
Read-only by design
The agent uses a publisher-verified Microsoft Entra app with read-only permissions. It reads rule and forwarding configuration only, never message content. You can revoke access in one click from Entra ID.
How to check your tenant manually (free)
- In the Microsoft Defender portal, open the outbound spam filter policy and check whether automatic external forwarding is allowed.
- In Exchange Online PowerShell, run
Get-InboxRule -Mailbox <user>for your finance and executive mailboxes. - Look for rules with ForwardTo, RedirectTo or DeleteMessage set, or with odd names.
- Repeat regularly, or let the agent do it across every mailbox.
Pricing
Included in Monitoring Plus, from ₹14,399 a month (about $169) for up to 50 Microsoft 365 users, with the price set by team size. See the pricing page for every band, in rupees or dollars. Monitoring Plus can also be bought through Microsoft Marketplace as a private offer; ask us.
Frequently asked questions
What is a hidden inbox rule?
A mailbox rule created by an attacker to forward, move or delete messages so the real user doesn't see them. It is one of the most common persistence tricks in BEC.
Does the agent read our emails?
No. It reads mailbox rule and forwarding settings only, through read-only Microsoft Graph permissions.
Doesn't Microsoft Defender already alert on this?
Some Defender plans raise alerts for suspicious forwarding, depending on licensing and policy configuration. The agent checks every mailbox regardless of plan and explains each finding with the fix.
Which Microsoft 365 plans does it work with?
Any plan with Exchange Online mailboxes.
Can we cancel anytime?
Monthly billing can be cancelled at any time. Yearly billing is 10 months for 12.