Suspicious Inbox Rules

The question it answers: Which inbox rules delete, hide or forward mail about invoices, payments or passwords, as attackers set up after taking over a mailbox?

After taking over a mailbox, attackers add inbox rules that delete or bury replies about ‘invoice’, ‘payment’ or ‘password’ so the victim never sees the fraud unfolding - often moving them to RSS Feeds or Archive. This scan reads every user and shared mailbox’s inbox rules and lists the ones matching those patterns.

Note

The scan runs one Get-InboxRule per mailbox in the single PowerShell runspace - on large tenants it takes a long time and other PowerShell reports wait until it finishes. External forwarding rules also appear in the existing ‘Outlook Clients With External Forwarders’ report.

At a glance

Where in the app	Exchange Online › Mail Security Posture › Suspicious Inbox Rules
Workload	Exchange Online
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.posture.suspicious-inbox-rules

Columns

Column	Key	Type
Mailbox	Mailbox	Text
Rule	RuleName	Text
Why	ReasonsString	Status
Enabled	Enabled	YesNo
Conditions	Conditions	Text
Rule description	Actions	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-EXOMailbox
• Get-InboxRule -Mailbox (per mailbox)

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.suspicious-inbox-rules?size=100
POST /ir-api/v1/reports/exchange.posture.suspicious-inbox-rules/scan

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.suspicious-inbox-rules. The client needs the Run scan grant for Exchange Online. See Using the API.