How to find hidden inbox rules in Microsoft 365

By Kiran D, Principal Consultant — Cybersecurity & Privacy · 2026-10-21

If someone has stolen a password in your organisation, an inbox rule is often the first thing they create. It forwards mail to an outside address, or quietly moves or deletes messages so the real user never sees them. Here is how to check for one yourself, and what to do if you find it.

What a suspicious rule looks like

• It forwards or redirects mail to an address outside your organisation.
• It matches financial words: invoice, payment, bank, wire, remittance.
• It has a blank or odd name, such as a single dot, or it is set to stop processing other rules.
• It deletes messages or marks them as read, so nothing shows in the inbox.
• It was created recently, on an account whose owner doesn't change settings.

Step 1: check automatic forwarding

In the Microsoft Defender portal, open the outbound spam filter policy and see whether automatic external forwarding is allowed. If it is set to automatic, you have a wide-open door. Setting it to Off blocks most forwarding abuse, though not every route.

Step 2: list the rules on key mailboxes

Connect to Exchange Online PowerShell and run this for your finance team, executives and anyone who handles payments:

Get-InboxRule -Mailbox user@yourcompany.com | Format-List Name, Enabled, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage, MarkAsRead, StopProcessingRules, Description

Read the Description of any rule that has ForwardTo, RedirectTo or DeleteMessage set. Also check for rules you cannot see in Outlook: Get-InboxRule -Mailbox user@yourcompany.com -IncludeHidden.

Step 3: if you find one

1. Remove the rule.
2. Reset the user's password and revoke their sessions.
3. Check sent items and the sign-in log for the period the rule existed.
4. Tell your finance team to verify any recent bank-detail change by phone.
5. Look for the same pattern in other mailboxes.

Doing this at scale

Checking mailboxes one by one works for a handful of users and does not scale to a whole tenant. Zybim's Threat Detection Agent checks every mailbox about once a day, read-only, and alerts you with the fix. It reads rule settings only, never message content.

Related: Preventing business email compromise · Free email security check