What Changed
Mailbox rule abuse remains a durable post-compromise tactic. In hybrid deployments, investigators found that forwarding and message deletion rules were often created within minutes of suspicious sign-in activity and remained undetected for extended periods.
Operational Impact
Teams with mailbox rule change monitoring detected compromise progression earlier than those relying only on user-reported anomalies. Rule forensics also improved blast-radius assessment by revealing attacker objectives and target contacts.
Response Priorities
Remediation efforts were most effective when coordinated across identity, email, and finance stakeholders. Purely technical cleanup without business workflow review left gaps for recurring fraud attempts.