# How do you find and block malicious inbox rules and auto-forwarding?

URL: https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> How attackers use inbox rules and forwarding to hide replies and copy mail, how to find them in Outlook, PowerShell and Gmail, and how to block forwarding.

## Short answer

Attackers who get into a mailbox create inbox rules that delete or hide replies and forward mail to outside addresses. Find them with Get-InboxRule -IncludeHidden and the Auto forwarded messages report in Microsoft 365, or the Filters and Forwarding settings in Gmail. Block them by setting external auto-forwarding to Off in the outbound spam policy.

An inbox rule is the quietest thing an attacker leaves behind. It needs no malware, survives a password change, and keeps working until someone looks. This guide shows what malicious rules and forwarding look like, how to find them in Microsoft 365 and Google Workspace, and how to block external auto-forwarding at the tenant level.

## Why do attackers create inbox rules?

Once inside a mailbox, an attacker has two problems: the real owner might notice replies to the attacker's messages, and access might be cut off. Rules solve both. Microsoft's [Defender XDR playbook](https://learn.microsoft.com/en-us/defender-xdr/alert-grading-playbook-inbox-manipulation-rules) says attackers "might also set rules in the compromised user mailbox to delete emails, move the emails into another less noticeable folder (like RSS), or forward mails to an external account." It adds that "malicious inbox rules are common during business email compromise (BEC) and phishing campaigns."

MITRE ATT&CK tracks these as two techniques:

- **[Email Hiding Rules (T1564.008)](https://attack.mitre.org/techniques/T1564/008/):** rules used "to delete and/or move emails to less noticeable folders", often to hide replies to phishing sent from the account.
- **[Email Forwarding Rule (T1114.003)](https://attack.mitre.org/techniques/T1114/003/):** "Adversaries may setup email forwarding rules to collect sensitive information." Forwarding keeps feeding the attacker mail even after the password is reset.

Rules are stored with the mailbox and run on the server, so they keep working whether or not the user is signed in, and changing the password doesn't remove them. That's why Microsoft's compromised-account steps treat rules and forwarding as a separate item from the password reset.

Hiding rules are what make [thread hijacking](https://iblockspam.com/blog/email-thread-hijacking) work: the supplier never sees the customer's "Are these new bank details right?" reply.

## What do malicious rules look like?

These patterns come from Microsoft's investigations and the MITRE technique pages:

| Pattern | Typical setup | Why the attacker wants it |
|---|---|---|
| Hide everything | Move all incoming mail to Archive or RSS Subscriptions and mark as read | The user sees an empty-looking inbox and nothing alarming |
| Delete everything | Delete all incoming mail | Microsoft says a "delete all incoming emails" rule without keywords "is an indicator of malicious activity" |
| Keyword hiding | Delete or move mail containing words such as "invoice", "phish", "hack", "suspicious" or "do not reply" | Hides replies and security warnings about the fraud |
| Single-contact hiding | Move mail from one supplier or customer to an obscure folder | Hides the target of a payment fraud while the attacker writes as the user |
| External forwarding | Forward, redirect or forward as attachment to an outside address | Copies every message out, even after a password reset |

Real examples: in one Microsoft case, the rule moved mail from the fraud target to the Archive folder and marked it as read ([Microsoft, 2022](https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/)). In a 2026 campaign, the rule deleted all incoming mail and marked it as read.

## How do you check a mailbox in Outlook?

For a quick check of one mailbox with the user:

- **New Outlook and Outlook on the web:** **Settings** > **Mail** > **Rules**, then **Settings** > **Mail** > **Forwarding**.
- **Classic Outlook for Windows:** **File** > **Manage Rules & Alerts**.

Look for rules the user doesn't recognize, rules with odd names, and anything that deletes, moves to an unusual folder, marks as read or forwards. Don't stop here, though. MITRE notes attackers can modify a rule through MAPI so it is "hidden and not visible from Outlook, OWA or most Exchange Administration tools." Use PowerShell to be sure.

## How do you check every mailbox with PowerShell?

[Get-InboxRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-inboxrule) has an `-IncludeHidden` switch that "specifies whether to include hidden Inbox rules in the results." Connect with `Connect-ExchangeOnline`, then check one mailbox:

```powershell
Get-InboxRule -Mailbox user@example.com -IncludeHidden |
    Format-List Name, Enabled, Description, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage, MoveToFolder, MarkAsRead
```

To sweep the whole tenant for rules that forward, redirect, delete or move mail:

```powershell
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName -IncludeHidden |
        Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage -or $_.MoveToFolder } |
        Select-Object MailboxOwnerId, Name, Enabled, ForwardTo, RedirectTo, DeleteMessage, MoveToFolder, Description
} | Export-Csv inbox-rules.csv -NoTypeInformation
```

Review the results rather than deleting everything they return: plenty of move rules are legitimate, so ask the user about anything you're unsure of. Then check admin-set mailbox forwarding, which doesn't appear as an inbox rule:

```powershell
Get-Mailbox -ResultSize Unlimited |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Format-Table UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward
```

To remove what you find, record each rule first, then use `Remove-InboxRule -Mailbox user@example.com -Identity "<rule name>"`, and clear mailbox forwarding with `Set-Mailbox user@example.com -ForwardingSmtpAddress $null`.

### Check when rules were created

In Defender XDR advanced hunting, look for the Exchange Online actions `New-InboxRule`, `Set-InboxRule`, `UpdateInboxRules` and `Set-Mailbox` in `CloudAppEvents`. Microsoft's playbook includes a query that shows the IP address, location and rule configuration for each change. A rule created from an unfamiliar country or ISP minutes after a phishing click is a strong signal.

## How do you find forwarding in the Exchange admin center?

The **Auto forwarded messages report** in the new Exchange admin center shows mail automatically forwarded to external domains ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-reports/mfr-auto-forwarded-messages-report)). It breaks forwarding down by type (**Mail flow rules**, **Inbox rules** and **SMTP forwarding**), recipient domain and forwarding user. It shows the last 7 days by default, and the summary can query up to 90 days.

Two related insights, **New domains being forwarded email** and **New users forwarding email**, highlight changes. Check the report monthly at minimum; a forwarder you can't explain needs investigating.

## How do you block external auto-forwarding in Microsoft 365?

The outbound spam policy is the control that covers both inbox rules and admin-configured mailbox forwarding ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)). Its **Automatic forwarding rules** setting has three values:

| Value | Effect |
|---|---|
| **Automatic - System-controlled** (default) | Changed to mean Off in 2021 for new organizations, but "can remain equivalent to **On**" for some existing ones |
| **On - Forwarding is enabled** | External auto-forwarding is allowed |
| **Off - Forwarding is disabled** | External auto-forwarding bounces with `5.7.520 Access denied, Your organization does not allow external forwarding` |

Because the default can differ between tenants, Microsoft says to choose On or Off explicitly. To set it:

1. In the Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-spam**.
2. Open **Anti-spam outbound policy (Default)** and edit **Protection settings**.
3. Set **Automatic forwarding rules** to **Off - Forwarding is disabled** and save.

Or run `Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off`. Forwarding between internal users isn't affected. If someone has a genuine need, create a custom outbound policy set to **On** for just that user. Our guide to [Microsoft 365 mail flow rules for security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security) explains how this combines with remote domains and transport rules, and the [550 5.7.520 page](https://iblockspam.com/smtp-errors/550-5-7-520) covers the bounce users see.

Blocking forwarding doesn't remove hiding rules. You still need the sweep above.

## How do you check Gmail filters and forwarding?

In Gmail, filters do the job of inbox rules. For one user:

1. Open **Settings** > **See all settings**.
2. Check **Filters and Blocked Addresses** for filters that delete, archive, skip the inbox, mark as read or forward.
3. Check **Forwarding and POP/IMAP** for a forwarding address, and select **Disable forwarding** if it shouldn't be there ([Gmail Help](https://support.google.com/mail/answer/10957?hl=en)).

Gmail shows a "You are forwarding your email to..." notice, but only for the first week after forwarding is turned on, so don't rely on users noticing it.

For admins, Google's [compromised account guidance](https://knowledge.workspace.google.com/admin/support/troubleshooting/identify-and-secure-compromised-accounts) notes that "you can retrieve user account settings (such as forwarding settings) through the Gmail API", which is how to audit at scale.

To restrict forwarding across the domain ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails)):

1. In the Admin console, go to **Apps** > **Google Workspace** > **Gmail** > **End User Access**.
2. Under **Automatic forwarding**, clear **Allow users to automatically forward incoming email**, or limit it to internal email addresses only.
3. Apply it to the whole organization or to specific organizational units, and save.

The setting is on by default. When it's off, "the forwarding option isn't available in Gmail settings."

## What should you do when you find a malicious rule?

A malicious rule means someone had access to the mailbox. Microsoft's playbook recommends disabling the rule, resetting credentials, searching for other activity by the account, and checking for activity from the same IP or ISP across the tenant.

1. **Record the rule** (screenshot or export) before deleting it. You'll need it to scope the incident.
2. **Revoke sessions and reset the password.** A password reset alone isn't enough if the attacker holds a session; see [AiTM phishing and MFA bypass](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass).
3. **Remove unknown MFA methods and app consents.** See [OAuth consent phishing](https://iblockspam.com/blog/oauth-consent-phishing-microsoft-365).
4. **Delete the rules and forwarding.**
5. **Review hidden folders** (Archive, RSS Subscriptions, Deleted Items) for messages the user never saw.
6. **Check sent mail** for payment requests, and phone anyone who may have acted on one.
7. **Sweep other mailboxes** for the same rule name or pattern.

Our guide to [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) has the full response checklist.

## Next steps

1. Run the tenant-wide PowerShell sweep today and review every forwarding or delete rule.
2. Set external auto-forwarding to Off explicitly in Microsoft 365, or restrict it in Google Workspace.
3. Put the Auto forwarded messages report on a monthly checklist.
4. Cut the phishing that leads to compromised mailboxes. iBlockSpam filters phishing, spoofing and malware at the MX; see [how it works](https://iblockspam.com/how-it-works). If users report bounces after you block forwarding, paste them into the [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What does a malicious inbox rule usually look like?

Typically it moves messages to a folder nobody checks, such as RSS Subscriptions or Archive, and marks them as read, or it deletes them outright. Some apply to all mail; others only to messages containing words like invoice, phish or hack. Forwarding rules send copies to an outside address. A rule with no condition at all is also suspicious.

### Why doesn't a rule show up in Outlook?

Some rules are hidden. MITRE describes attackers using MAPI to modify rule properties so a rule is not visible from Outlook, Outlook on the web or most Exchange admin tools. In Exchange Online, run Get-InboxRule with the IncludeHidden switch to list hidden rules as well. Classic Outlook can also hold client-side rules that run only on one computer.

### Is external forwarding blocked by default in Microsoft 365?

Usually, but not reliably. The default setting, Automatic - System-controlled, has meant Off for new organizations since 2021, but Microsoft says some older tenants that were using it can still treat it as On. Microsoft recommends choosing On or Off explicitly. Its Standard and Strict recommended settings are both Off.

### Can Google Workspace block forwarding to outside addresses?

Yes. In the Admin console under Apps, Google Workspace, Gmail, End User Access, the Automatic forwarding setting is on by default. You can turn it off, or limit forwarding to internal email addresses only, and apply the change to specific organizational units. When it's off, the forwarding option disappears from users' Gmail settings.

### What should I do after deleting a malicious rule?

Treat the account as compromised. Revoke sessions, reset the password, remove unknown MFA methods and app consents, and check what was sent and forwarded while the rule existed. Then look for the same rule pattern in other mailboxes, because attackers often reuse it. Warn anyone who may have received fraudulent messages, by phone for payments.

## Sources

- [Microsoft Learn: Alert classification for suspicious inbox manipulation rules](https://learn.microsoft.com/en-us/defender-xdr/alert-grading-playbook-inbox-manipulation-rules)
- [Microsoft Learn: Get-InboxRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-inboxrule)
- [Microsoft Learn: Control external email forwarding and fix 5.7.520 errors](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- [Microsoft Learn: Auto forwarded messages report in the new Exchange admin center](https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-reports/mfr-auto-forwarded-messages-report)
- [MITRE ATT&CK: Email Hiding Rules (T1564.008)](https://attack.mitre.org/techniques/T1564/008/)
- [MITRE ATT&CK: Email Forwarding Rule (T1114.003)](https://attack.mitre.org/techniques/T1114/003/)
- [Google Workspace Admin Help: Let users automatically forward their own Gmail emails](https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails)
- [Gmail Help: Automatically forward Gmail messages to another account](https://support.google.com/mail/answer/10957?hl=en)

## Free tools for this guide

- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt