Someone created an email forwarding rule in their mailbox. Now what?

At 9:12 on a Tuesday, an alert shows up in Microsoft Defender. Someone in accounts payable created a rule in their mailbox that forwards every email containing the word “invoice” to a Gmail address. Whoever is on call in the security operations center looks at it, assumes it is someone who wants to read work email on their phone, and closes it. Nobody writes to the person. Nobody asks whether they created the rule.

Maybe they did. Or maybe they didn’t, and someone has spent the last hour reading the organization’s conversations with its suppliers.

Why is an email forwarding rule a sign of fraud?

Because it is one of the first moves of whoever takes over an email account. The rule forwards the messages the attacker cares about outside the organization, or hides them, so the person cannot see what is happening in their own mailbox. In its investigation guide for inbox manipulation rules, Microsoft describes rules that delete emails, move them to an inconspicuous folder such as RSS feeds, or forward them to an external account, filtering for words like “invoice”.

This is not a rare case. According to a 2026 email threats report, 25% of account takeover incidents involved suspicious changes to inbox rules, such as forwarding emails to external accounts or automatically deleting security notifications. And one detail changes the usual response. The technique is catalogued in MITRE ATT&CK as T1114.003, which warns that the rule keeps working even after the account password is reset.

With that rule in place, the attacker reads the conversation with a real supplier, waits for the invoice and sends their own with different bank details, from a place the victim no longer sees. It is the prelude to CEO fraud in its supplier version.

Why does the alert get closed as noise?

Because most of the time the case is innocent, and whoever reviews it knows that. In its guide on forwarding rules, Microsoft acknowledges that maintaining rules is a common task for any user, and its investigation steps include ruling out forwarding to another mailbox the same person owns. The default policy that raises the alert, “Creation of forwarding/redirect rule”, also has the lowest severity on the list, Informational.

So the alert arrives, it looks like the usual person forwarding work to themselves, and it gets closed. It gets closed without anyone talking to the only person who knows whether the rule is theirs.

The alert has two limits you should know before relying on it. According to the same Microsoft documentation, it only tracks rules created in Outlook on the web or through PowerShell, not those created in the Outlook desktop app. And whether external forwarding is blocked depends on each organization’s configuration, so you cannot take it for granted.

Why isn’t a campaign about forwarding rules enough?

The usual reaction is to add the topic to the next awareness campaign. That has two costs. The campaign arrives weeks after the event, when the rule has already done its job or been forgotten. And it reaches the whole organization, when 99% of people have never created a rule and find the message irrelevant.

The person who matters, meanwhile, gets it late and mixed in with everything else. How well this message works depends on two things a campaign lacks, timing and the right person. It is the same reason nudges work when they arrive at the right moment.

What does the message need to tell the person?

The message speaks to someone who may or may not have created the rule, so it has to work in both cases and cannot sound like an accusation.

1. What happened, in one sentence. A rule was created that forwards emails from your mailbox to an external address, with the time.
2. If it was you. Why work email should not leave the organization, what to do instead and how to undo the rule.
3. If it wasn’t you. Your account may be compromised, and the security team needs to know right now. The message says whom to contact and through which channel.
4. Through a channel other than email. If the account is compromised, the mailbox is exactly what the attacker controls. The attacker can read an email notice, or the very rule you want to flag can divert or delete it. Microsoft Teams or Slack are safer for this message.

The third point is what justifies the whole effort. A person who answers “it wasn’t me” within twenty minutes saves the security team an entire investigation.

How does SMARTFENSE respond to an email forwarding rule?

SMARTFENSE integrates with Microsoft Defender and picks up its alerts, including the creation of a forwarding or redirect rule and suspicious forwarding activity. Each one can trigger a Nudge, a short message that reaches the person involved by email, Slack or Microsoft Teams within minutes of the alert. Your organization writes the text or picks it from the gallery, so the message for both cases is ready in advance. If you are writing it from scratch, this guide to writing a nudge is a good starting point.

A Playbook can run on the same event and alert the process. It can call a webhook to open a case in the ticketing system, or notify the security operations center through Teams or Slack, so the alert no longer gets closed on its own.

This has two requirements you should be clear about from the start. The Microsoft Defender integration has to be active, and people have to be synced from Microsoft Entra ID, because that is how the platform knows whom the alert belongs to.

What do you measure?

The main indicator is the share of rules that are removed within 24 hours of the message to the person. SMARTFENSE does not measure that figure. It comes from the Exchange or Microsoft Defender logs, which is where the rule’s removal is recorded. Matching it against the time of the message takes an afternoon’s work.

Next to it goes a second number, how many cases the security operations center resolved with the person’s answer, without investigating from scratch. That is the one that turns awareness into an operational saving the security team can verify on its own, and it is the one that resonates most with people who don’t usually buy awareness.

The following Tuesday

The next time the 9:12 alert shows up, the person in accounts payable will get a message in Teams before anyone closes it. If the rule was theirs, they undo it and learn something no general campaign would have taught them in time. If it wasn’t, the security team finds out from the only person who could know.

If you want to see how Microsoft Defender connects with Nudges and Playbooks in your organization, you can request a platform demo.