Multiple inbox rules created in an Exchange Online mailbox within a short period

A threat actor who gains access to an Exchange Online mailbox may create multiple inbox rules to conceal emails – tactics commonly used in Business Email Compromise (BEC) attacks to evade detection and maintain access.

The threat is detected based on the creation of multiple new inbox rules in a given period of time.

Detection is scheduled to run regularly across all Entra tenants and will trigger an alert when particular number of new inbox rules are created in a particular period of time. Both the minimum rules number and the time period are adjustable in the Rule settings.

A threat actor who gains access to an Exchange Online mailbox may create a new inbox rule to delete, move, or forward incoming emails – tactics commonly used in Business Email Compromise (BEC) attacks to evade detection and maintain access.

The threat is detected based on the creation of new inbox rules that meet any of the following criteria:

• Move emails to Deleted Items
• Mark emails as Read
• Forward emails to external domains

Detection is scheduled to run regularly across all Entra tenants and will trigger an alert when:

• A new inbox rule with one or more of the above suspicious actions is created
• The rule is created by someone other than the mailbox owner (e.g., via delegated access or compromised credentials)

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.