Covert Inbox Rule Signals Account Compromise via Anonymous Proxy

Initial Signal

On April 23, 2026, Microsoft Defender for Cloud Apps detected a suspicious inbox rule creation in the mailbox of user_1@[INTERNAL_DOMAIN_1].com, a Director of [ROLE_1] at [ORG_1]. The alert was triggered by a Set-InboxRule operation (MITRE T1564.008 — Email Hiding Rules) executed from an anonymous proxy IP ([EXTERNAL_IP_1], DataCamp Limited, Frankfurt, Germany) at 20:01:40Z. What made this signal stand out: the rule was named "Alex Morgan" and configured to silently intercept emails containing specific keywords (`contact1@[EXTERNAL_DOMAIN_1].com`, `Alex Morgan`, `contact2@[EXTERNAL_DOMAIN_2].com`), marking them as read and moving them to the RSS Subscriptions folder—a classic concealment pattern with no legitimate business justification. The investigation correlated this alert with 81 successful Exchange Online operations executed from the same anonymous proxy IP during a 46-minute window (19:15:59Z–20:02:00Z), including 44 MailItemsAccessed events and 36 Update operations modifying attachment collections across business-sensitive folders. Critically, no Entra ID sign-in record existed for the proxy IP, indicating the attacker was reusing a session token obtained from an earlier legitimate sign-in. The session ID (8f3e2b7d-1a9c-4f0e-bc35-d927416a5f1c) appeared in successful authentications from Santa Clara, Chicago, and Sand Springs within approximately two hours—geographically implausible for a Nashville-based employee whose device remained active in Nashville throughout the period. An administrator confirmed the account as compromised (riskState: confirmedCompromised, riskDetail: adminConfirmedUserCompromised) approximately 30 minutes after the inbox rule event, marking the end of the autonomous investigation phase (~5 minutes across 42 data source queries).

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. FPV-1
   Check whether the anonymous proxy IP ([EXTERNAL_IP_1]) could represent a corporate VPN or authorized remote access infrastructure.
   Fail
2. FPV-2
   Evaluate whether the inbox rule 'Alex Morgan' could have been created by the legitimate user for a benign purpose.
   Fail
3. FPV-4
   Verify whether the administrator confirmation of compromise (riskDetail: adminConfirmedUserCompromised) could be an error or automated action.
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Account Compromise at high confidence rests on the following mutually corroborating signals:

1. Authenticated mailbox access from a classified anonymous proxy IP (DataCamp Limited, VPN score 100) with no corresponding Entra sign-in record, indicating token reuse rather than credential presentation—81 successful Exchange operations executed in a 46-minute window

2. A covert inbox rule with specific keyword targeting (`contact1@[EXTERNAL_DOMAIN_1].com`, `Alex Morgan`, `contact2@[EXTERNAL_DOMAIN_2].com`) configured to hide correspondence without deletion, a pattern inconsistent with legitimate user behavior and flagged as UncommonForUser by Defender for Cloud Apps

3. Session token reuse across geographically dispersed IPs (Santa Clara, Chicago, Sand Springs) within ~2 hours on the same day, with authentication satisfied via "Previously satisfied" claims from an earlier MFA-completing sign-in, while the user's device remained active in Nashville

4. Administrator confirmation of compromise (riskDetail: adminConfirmedUserCompromised) recorded at 20:32:09Z, representing a deliberate human determination rather than an automated risk score

5. Credential exposure via 10 HIBP breaches including Operation Endgame

6. providing a plausible acquisition vector for the initial compromise. Confidence is High rather than Confirmed because the available telemetry does not evidence post-exploitation objectives beyond the email account itself (no lateral movement, no endpoint compromise, no external data staging), leaving the full scope of attacker objectives undetermined

Lessons

1. 01
   Session token reuse is harder to detect than credential reuse. In this investigation, the attacker obtained a valid session token from a legitimate MFA-completing sign-in (Santa Clara, 17:58:32Z) and reused it across four geographically implausible IPs within two hours. The absence of Entra sign-in records for the anonymous proxy IP initially appeared to be a gap in telemetry; in fact, it was the key indicator of token reuse. Lesson: when an IP shows successful cloud application activity but no corresponding Entra sign-in record, investigate whether the session token was obtained from a prior sign-in. Correlate session IDs across Exchange audit logs, Defender for Cloud Apps, and Entra logs to detect token reuse patterns that credential-based detection would miss.
2. 02
   Inbox rule concealment patterns are more reliable than forwarding rules. This attacker did not create an external forwarding rule (which would trigger immediate alerts and leave obvious exfiltration paths). Instead, they created a rule that marks targeted emails as read and moves them to a non-standard folder (RSS Subscriptions), hiding correspondence from the legitimate user without deleting it. This pattern is harder to detect because it does not involve external recipients or bulk data movement. Lesson: monitor for inbox rules that combine three elements: (1) non-standard destination folders, (2) keyword triggers matching the user's known external contacts, (3) stop-processing directives that prevent other rules from executing. These patterns indicate surveillance and concealment, not legitimate mail organization.
3. 03
   Attacker reconnaissance is visible in Safe Links telemetry. The attacker created an inbox rule targeting `contact2@[EXTERNAL_DOMAIN_2].com` as a keyword trigger. On the same day, the legitimate user had clicked Safe Links to `[EXTERNAL_DOMAIN_2]-my.sharepoint.com` from the Nashville corporate IP. This correlation suggests the attacker reviewed the user's email to identify high-value external contacts before creating the interception rule. Lesson: when investigating inbox rule creation, cross-reference the rule's keyword triggers with the user's recent Safe Links clicks and email activity. If the keywords match recent external contacts, the attacker likely performed mailbox reconnaissance before installing persistence mechanisms.
4. 04
   Administrator confirmation of compromise is a strong signal, but scope remains uncertain. The administrator confirmed the account as compromised (riskDetail: adminConfirmedUserCompromised) 30 minutes after the inbox rule event. This human judgment carries high weight and correctly identified the compromise. However, the available telemetry does not evidence post-exploitation objectives beyond the email account itself—no lateral movement, no endpoint compromise, no external data staging. Lesson: administrator confirmation should trigger immediate containment (password reset, session revocation, MFA re-registration), but the investigation should continue to determine whether the attacker accessed other systems, exfiltrated data, or established additional persistence mechanisms. Do not assume the scope of compromise is limited to the email account.
5. 05
   HIBP breach data provides plausible acquisition vectors, not proof of compromise. The user's email appeared in 10 HIBP breaches, including Operation Endgame (2024). This data supports the hypothesis that the attacker obtained credentials through a prior breach and used them to compromise the account. However, HIBP data alone does not prove when or how the compromise occurred. Lesson: use HIBP breach data to contextualize the compromise (e.g., 'credentials were exposed in a known breach'), but do not rely on it as the sole evidence of account compromise. Correlate with sign-in logs, mailbox access patterns, and inbox rule creation to establish a timeline and confirm the compromise occurred after the breach.