The classic signs of a hijacked mailbox are unexpected inbox rules, new external forwarding, odd messages in Sent or Deleted Items, and repeated password changes or lockouts. Check them regularly and alert on new rules and forwarding, because attackers use both to hide replies and keep reading mail.
The signs Microsoft lists
Microsoft's guidance on compromised accounts names these symptoms:
- The mailbox is blocked from sending email.
- Missing or deleted email.
- Rules that forward email to unknown addresses.
- Rules that move messages to Notes, Junk Email or RSS Subscriptions.
- Suspicious messages in Sent Items or Deleted Items, such as a plea for money.
- Changes to the user's entry in the address list.
- Frequent password changes or unexplained lockouts.
- Recently added external forwarding.
- Odd email signatures.
Any one can have an innocent cause. Two or three together deserve action.
Why rules matter so much
In Microsoft's documented AiTM to BEC case, the attacker created a rule that moved mail from the fraud target into the Archive folder and marked it read. The victim never saw the replies. The attacker also deleted their own sent replies. A mailbox can look normal while a conversation is being steered.
Rules can also be hidden. Microsoft's checking command includes a flag to include hidden rules, which is why a quick glance at the Rules page in Outlook is not enough.
What to check
- Inbox rules including hidden ones, looking at redirect, forward and forward-as-attachment fields.
- Mailbox level forwarding settings for internal and external addresses.
- Tenant level external forwarding policy, so users cannot set it up unnoticed.
- Recent sign-ins for unfamiliar locations or IP addresses.
- MFA methods and consented apps.
What to alert on
Build detections that fire when a rule is created that deletes, archives or forwards mail, especially mail containing words like invoice or payment. Alert when external forwarding is enabled. Alert on sign-ins from new devices followed by rule creation within minutes. Speed matters, since Microsoft reported fraud beginning as quickly as five minutes after session theft.
When you find something
Use the ordered steps in the mailbox response checklist. Do not just delete the rule. The attacker's access is the real problem.
A weekly routine that takes ten minutes
Pick a small set of high value mailboxes: finance, executives, administrators and anyone who handles vendor payments. Once a week, list their rules and forwarding settings and compare against last week. The goal is to catch a quiet change, not to prove that nothing happened. Put the output in a shared place so a second person can read it, and keep the list short enough that the routine survives a busy month.
Quick check
I deleted the suspicious rule. Am I done?
No. The attacker may still have a session, an added MFA method or an app consent. Follow the full response steps.
Can users see every rule in Outlook?
Not necessarily. Hidden rules exist, so administrators should check with a method that includes them.
Sources
- Respond to a compromised email account in Microsoft 365 (Microsoft Learn)
- From cookie theft to BEC (Microsoft Security blog)
Last reviewed: 19 October 2026.
