Find and remove malicious inbox rules after an Office 365 account hack.
An unexpected rule can hide replies, delete warnings or send messages elsewhere. Record what it does before changing it, while keeping the compromised account contained.
First, stop unauthorised access
Use the account recovery checklist. Removing one suspicious rule while the attacker still has access can leave them able to add it again.
Inspect the rules, including hidden ones
An authorised Exchange administrator can use Exchange Online PowerShell. After connecting to the correct tenant, replace the example address below. These commands inspect settings; they do not change them.
Get-InboxRule -Mailbox "affected@example.com" -IncludeHidden |
Format-List Identity,Name,Enabled,DescriptionCheck conditions and actions, not just names. A short or innocent-looking name does not make a rule safe. Preserve the result securely and record the collection time. Use the report template for rule IDs, destinations, evidence references and disposition.
Disable a verified malicious rule carefully
Once the relevant evidence is captured and the rule identified, an authorised administrator can disable that specific rule. Use its exact identity from your results; do not run a bulk “delete all rules” command.
Disable-InboxRule -Mailbox "affected@example.com" -Identity "EXACT_RULE_ID"Read the confirmation and warnings. Microsoft warns that modifying rules through Exchange PowerShell can remove Outlook client-side rules. Assess the impact, retain a record of existing rules and avoid force switches that hide warnings. Re-run the read-only inspection to verify the outcome.
Check forwarding outside inbox rules
Mailbox-level forwarding is a separate setting. Review it through Microsoft’s compromised-account procedure, alongside mailbox delegation and app access. An empty rule list is not proof that no mail can leave the mailbox.
Did the rule actually forward any emails?
A destination in a rule establishes its configuration, not a confirmed count of exposed messages. Correlate the available audit history and message evidence across the investigation window. Keep “configured”, “observed” and “unknown” distinct. Deleted or moved emails may also matter to the incident.
If the rule reappears
Keep access blocked, record the recurrence and investigate the remaining access path. Do not treat repeated rule deletion as a completed fix. Read about ongoing inbox-rule monitoring once containment and recovery are under control.
Microsoft references
- Get-InboxRule, including hidden rules
- Disable-InboxRule and client-side rule impact
- Full compromised mailbox investigation
Reviewed 18 October 2026. Portal wording and access vary by role, tenant and licensing. Follow your organisation’s incident procedure.