ChecklistCONSTRUCTEDUntested

First 15 minutes: a new inbox rule forwards, deletes or hides mail

An inbox rule is rarely the attack. It is the evidence that somebody is inside the mailbox and wants to stay unseen. Keep it, read it for intent, and close the account behind it.

high severityCollectionT1114.003T1564.008

The clock starts when

An alert or a user reports a new inbox rule that forwards mail outside, deletes it, or moves it to an obscure folder such as RSS Feeds, Archive or Conversation History.

0 of 9 done

minutes 0 to 5

Keep the rule as evidence

Export the rule with every condition and action before you change it.The keywords it filters on, such as invoice, payment or bank, tell you what the attacker is waiting for.
Check mailbox-level forwarding as well as inbox rules.Forwarding set on the mailbox is not an inbox rule and does not appear if you only look for rules.
Find the audit record that created the rule: time, client address and app.It points at the session that has to be ended.

minutes 5 to 10

Close the account behind it

Disable the rule and the forwarding, revoke all sessions, and reset the password.
Review MFA methods, registered devices and app consents for the account.Any of them keeps access after the reset.
Search every mailbox for rules that forward externally or delete mail, created in the last 30 days.

minutes 10 to 15

Find what it was hiding

Read the folder the rule moved mail into, and deleted items, for the conversations being hidden.
If the rule mentions invoices, payments or bank details, tell finance now.That pattern is a payment fraud being set up, and finance can stop a transfer faster than you can.
Check message trace for mail sent from the account since the rule was created.Operators delete what they send from Sent Items. Message trace keeps it.

Do not

Do not delete the rule before exporting it.
Do not treat the rule as the incident. Somebody created it from inside the account.
Do not warn the other party to a payment thread by email from the affected mailbox.

Escalate now if

The rule filters on invoice, payment, bank, remittance or wire.
Mail was forwarded to an external address.
Other mailboxes have similar rules.

Minute sixteen. The checklist ends here and the response does not.

Open the business email compromise plan

Why this order

Deleting the rule feels like remediation and destroys the best evidence of intent you will get. A rule that moves anything containing "invoice" to RSS Feeds is a statement of what the operator is waiting for, and it is the thing that lets you warn finance before the fraudulent invoice arrives.

What this does not cover

A payment that has already been sent. If one has, stop reading and follow the invoice fraud playbook: the bank recall has a window measured in hours.

sources

Tags: first-15 · bec · email · m365 · inbox-rule · account-compromise · T1114.003 · T1564.008