Disable Mailbox Rule [FIX-9001]

It is used to neutralise a malicious inbox rule (for example one that auto-forwards, deletes, or moves mail to hide an attacker's activity) without destroying the evidence of what the rule did.

Rationale

Creating an inbox rule is a classic post-compromise action in business email compromise (BEC). After gaining access to a mailbox, an attacker commonly adds a rule that forwards incoming mail to an external address, or that moves and marks-as-read replies to their phishing and invoice-fraud messages so the real user never notices. These rules let the attacker keep reading or hiding mail even after the initial session ends.

Disabling the rule immediately stops it from acting on new mail. Keeping the rule in place (disabled) rather than deleting it preserves the exact conditions and actions for the investigation (which addresses were targeted, what was forwarded, what was hidden), which is valuable for scoping the incident and for any reporting obligations. Once the investigation is complete the rule can be deleted manually.

This remediation runs Disable-InboxRule against the mailbox via the Exchange Online connector and reads the rule back with Get-InboxRule to confirm. It requires the Exchange.ManageAsApp permission plus a directory role that allows cross-mailbox rule management (such as Exchange Administrator).

Fix

An automated fix is available through Attic.

Manual steps:

1. Open PowerShell and connect to Exchange Online: Connect-ExchangeOnline
2. List the rules for the affected user: Get-InboxRule -Mailbox user@domain.com
3. Disable the specific rule by name or ID: Disable-InboxRule -Mailbox user@domain.com -Identity "RuleName"
4. Verify the rule is disabled: Get-InboxRule -Mailbox user@domain.com | Select Name, Enabled

Impact

• The targeted inbox rule stops running and no longer forwards, moves, or deletes mail.
• The rule is disabled, not deleted; it remains visible for investigation and can be re-enabled or removed manually.
• Only the specified rule is affected; the user's other rules continue to work.
• Mail already actioned by the rule before it was disabled (e.g. already-forwarded messages) is not reverted.

Revert

Only revert a rule once investigation confirms it is legitimate; an attacker-created rule should be deleted, not re-enabled.

1. Connect to Exchange Online: Connect-ExchangeOnline
2. Re-enable the rule: Enable-InboxRule -Mailbox user@domain.com -Identity "RuleName"
3. Verify: Get-InboxRule -Mailbox user@domain.com | Select Name, Enabled

The user can also re-enable it themselves in Outlook under Settings > Mail > Rules.

The rule keeps its original conditions and actions, so nothing is lost by disabling it. Mail that arrived while the rule was off is not reprocessed; it stays where it was delivered.

More Information

• Microsoft: Disable-InboxRule
• Microsoft: Responding to a compromised email account
• MITRE ATT&CK T1564.008 – Email Hiding Rules