How Huntress Detects Hidden Inbox Rules Across Microsoft 365

PowerShell is the most direct manual way to find hidden inbox rules. The Get-InboxRule -IncludeHidden command is the industry standard for finding rules that are invisible to normal admin tools.

The -IncludeHidden parameter is key because it forces PowerShell to query the mailbox storage directly, bypassing the filters that hide malicious rules. This shows you all the rules in a mailbox, including those made through MAPI manipulation.

But running this manually across hundreds or thousands of accounts isn't practical. It's a time-consuming, one-off check that has to be scripted and run periodically just to find suspicious patterns.

Step 2: The deep dive (leveraging MAPI editor)

For an even deeper forensic-level inspection, MAPI editors let you access the underlying Exchange storage properties that standard clients can't reach.

Tools like MFCMAPI can find rules by looking directly at their storage properties, specifically the PR_RULE_MSG_NAME and PR_RULE_MSG_PROVIDER fields that hold the actual rule logic. This deep look can find sophisticated hiding techniques that even PowerShell might miss.

However, this isn't intended for routine checks. Using a MAPI editor is a labor-intensive process that takes special expertise and high-level permissions. It's typically only used for a targeted incident response, not for everyday monitoring.

• Pros:

• Deepest level of mailbox rule inspection available

• Reveals sophisticated hiding techniques

• Cons:

• Requires specialized technical expertise

• Time-intensive for large environments

• Limited automation capabilities

Step 3: The Huntress way (continuous)

Instead of relying on manual scripts, Huntress builds this detection directly into its platform. Our telemetry includes signals from both Azure Active Directory and Microsoft Exchange, covering a range of events from role escalations tosuspicious inbox rules and mailbox permission updates.

This approach does two key things:

• Finds Existing Rules: Huntress Managed ITDR is built to detect existing malicious inbox rules from the moment a tenant is onboarded. This includes finding "Shadow Workflows," which are malicious rules attackers use to hide activity by auto-forwarding or deleting messages.

• Correlates with Behavior: Huntress doesn't just look for a rule; we look at the whole picture. Our 24/7 SOC analysts correlate the creation of a suspicious rule with other activity, like a login from an unexpected location, to confirm a real compromise.

Malicious Rule Detection Workflow:

• Log Collection: Huntress gathers audit events for rule creation and other Exchange activities.

• Pattern Analysis: The platform automatically flags rules that target sensitive keywords (like "invoice") or move mail to unusual folders. Attackers specifically use these tactics, sometimes moving emails to less-viewed folders like "RSS Feeds" to hide their activity from the user.

• Behavioral Correlation: The system connects the new rule to other suspicious signals, like a strange login or privilege escalation.

• Expert Review: A human Huntress SOC analyst reviews the correlated data to verify the threat and rule out false positives.

• Response: The SOC initiates a response, which can include disabling the rule and isolating the account.

Step 4: Educating users on safe email handling

Teaching users about safe rule creation helps stop attackers from exploiting a simple gap in awareness. After all, the 2025 Verizon Data Breach Investigations Report found that 68% of breaches involve human error. Attackers often use phishing campaigns that trick users into creating their own forwarding rules.

Good security awareness training needs to cover these specific scenarios and teach your team what to look for.

User Best Practices for Email Rule Security:

• Never create forwarding rules to external email addresses without IT approval.

• Report any unusual requests to modify email settings or create automation.

• Regularly review existing rules and remove unnecessary automation.

• Escalate suspicious rule-related prompts or emails to security teams immediately.

Step 5: Responding to suspicious inbox rules with Huntress

When Huntress detects a suspicious inbox rule, our 24/7 SOC analysts verify the threat and take action.

The response is swift and documented. As part of a managed response, Huntress can revoke the compromised user session and disable suspicious email forwarding or inbox rules to stop the malicious activity. The analyst then handcrafts an incident report to communicate the impact and severity, so you know exactly what happened and what to do next.

The Huntress Identity Security Assessment gives organizations visibility into hidden inbox rules (which we call "Shadow Workflows"), risky login patterns, and rogue applications across their Microsoft 365 environment.