An inbox rule is an automated email action that processes incoming messages based on conditions such as sender, subject, or keywords. A rule can move mail to another folder, mark it as read, delete it, hide it in archives, or forward it to another address. In cloud mail systems like Microsoft 365, rules are often created for convenience, but they also change how messages are handled before a user notices them.
In cyber security, inbox rules matter because attackers use them to create quiet mailbox persistence. After compromising an account or stealing a valid session token, an intruder can add a rule that buries payment requests, suppresses security alerts, or forwards sensitive mail to an external inbox. This is a common tactic in business email compromise and other account-takeover attacks. Defenders look for newly created or modified rules, unusual forwarding destinations, and messages disappearing from the inbox. Monitoring mailbox audit logs and restricting risky forwarding can help catch abuse early.