Contoso Legal LLP
contoso.onmicrosoft.com
Rules to check
3
3 high risk
Forward outside
2
Rules sending mail out
Inbox rules
8
Across 22 mailboxes
3 rules out of 8 across 22 mailboxes forward outside the organisation, delete, or bury mail. These are the classic signs of a compromised mailbox: check each one with the mailbox owner.
| Mailbox | Rule | Why it stands out | What it does |
|---|---|---|---|
| annabel.fraser@ | . | Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank | body has invoice, payment: move to RSS Feeds; mark as read; stop processing rules |
| annabel.fraser@ | Copy to home | Forwards to annabel.fraser.home@ | All messages: forward to annabel.fraser.home@ |
| oliver.hill@contoso.example high | Invoices to bookkeeper | Forwards to bookkeeping@ | subject has invoice: forward to bookkeeping@ |
Every rule that forwards or redirects mail, including to colleagues.
| Mailbox | Rule | Enabled | Sends to | Outside the organisation |
|---|---|---|---|---|
| annabel.fraser@ | Copy to home | Yes | annabel.fraser.home@ | Yes |
| info@contoso.example | To manager | Yes | office.manager@ | No |
| oliver.hill@contoso.example high | Invoices to bookkeeper | Yes | bookkeeping@ | Yes |
| Mailbox | Rule | Enabled | Conditions | Actions |
|---|---|---|---|---|
| evie.davis@contoso.example | Newsletters | Yes | sender has newsletter | move to Newsletters |
Data from Inbox rules (), Mailboxes ().