Find the Forwarding Rules Outlook Can't Show You

Hidden email forwarding rules are inbox rules created at the MAPI (Messaging Application Programming Interface) level that silently redirect copies of incoming email to an external address. Unlike standard inbox rules you create through Outlook or OWA, these MAPI-level rules do not appear in the Outlook desktop client, Outlook on the web, or even the Microsoft 365 admin center's mail flow section.

Attackers exploit this visibility gap during business email compromise (BEC) attacks. After gaining access to a mailbox through credential phishing or token theft, they create a hidden forwarding rule that copies every incoming message — or messages matching specific keywords like "invoice," "wire," or "payment" — to an external mailbox they control. Because the rule is invisible to the end user and most administrators, it can persist for weeks or months after the initial compromise is remediated.

The root cause is a design limitation in how Microsoft Exchange represents inbox rules. Rules created via the MAPI ROP (Remote Operations) protocol use a binary blob format stored directly in the mailbox's associated contents table. The Outlook UI and OWA only render rules stored in a specific XML format, so MAPI-created rules simply don't appear. This isn't a bug — it's an architectural artifact that attackers have learned to weaponize.

The traditional approach to detecting hidden forwarding rules in Microsoft 365 is to run PowerShell commands like Get-InboxRule and Get-TransportRule across every mailbox in the tenant. While this works in theory, it has significant practical limitations. Running Get-InboxRule against hundreds or thousands of mailboxes is slow, requires elevated permissions, and produces output that must be manually reviewed. It's a point-in-time check — an attacker who creates a rule after your audit will go undetected until the next manual scan.

Automated detection tools like MailBreach take a fundamentally different approach. Instead of relying on periodic manual sweeps, MailBreach continuously monitors every mailbox in your tenant through the Microsoft Graph API and Gmail API. It inspects the full rule set — including MAPI-level rules, transport rules, and server-side forwarding configurations — and flags any rule that forwards, redirects, or copies email to an external address. Results are classified by severity using 12 detection patterns that map to known BEC tactics.

The advantage of automation goes beyond convenience. MailBreach maintains a baseline of known-good rules for each mailbox, so it can immediately detect when a new forwarding rule appears. It cross-references rules against your organization's domain allowlist to separate legitimate forwarding (like forwarding to a personal backup) from suspicious activity (like forwarding to a newly registered lookalike domain). This baseline-and-diff approach catches what periodic scans miss.