A mailbox rule is an email filter or automation setting that processes incoming or outgoing mail based on conditions such as sender, subject, or keywords. In Exchange and Outlook Web Access, rules can move messages, mark them read, forward them elsewhere, delete them, or hide them from the inbox.
Mailbox rules matter in cyber security because attackers often use them to stay quiet after gaining access. A malicious rule can forward copies of sensitive mail to an external address, bury warnings in folders the user never checks, or delete security alerts and password-reset messages. That makes the compromise harder to notice and can extend access even if the attacker loses the password. Defenders monitor for new or unusual rules, especially ones that contain forwarding, deletion, or inbox-suppression actions, and review mailbox audit logs for changes that do not match normal user behavior.