Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Detect And Remediate Outlook Rules Forms Attack

4 September 2026Doc update+21 / −25 lines

In brief

The article’s summary label and exploit lists were reformatted, and “may need” was changed to “might need” in the investigation guidance.

What Defender admins need to know

Administrators can use the revised article for attack recognition and remediation guidance; no administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

[!INCLUDE MDO Trial banner]

SummaryLearn how to recognize and remediate the Outlook rules and custom Forms injections attacks in Office 365.

What is the Outlook Rules and Custom Forms injection attack?

The attacks typically follow these patterns:

  • The Rules Exploit:

    1. The attacker steals a user's credentials.
    2. The attacker signs in to that user's Exchange mailbox (Exchange Online or on-premises Exchange).
    3. The attacker creates a forwarding Inbox rule in the mailbox. The forwarding rule is triggered when the mailbox receives a specific message from the attacker that matches the conditions of the rule. The rule conditions and message format are tailor-made for each other.
    4. The attacker sends the trigger email to the compromised mailbox, which is still being used as normal by the unsuspecting user.
    5. When the mailbox receives a message that matches the conditions of rule, the action of the rule is applied. Typically, the rule action is to launch an application on a remote (WebDAV) server.
    6. Typically, the application installs malware on the user's machine (for example, PowerShell Empire).
    7. The malware allows the attacker to steal (or steal again) the user's username and password or other credentials from local machine and perform other malicious activities.

  • The Forms Exploit:

    1. The attacker steals a user's credentials.
    2. The attacker signs in to that user's Exchange mailbox (Exchange Online or on-premises Exchange).
    3. The attacker inserts a custom mail form template into the user's mailbox. The custom form is triggered when the mailbox receives a specific message from the attacker that requires the mailbox to load the custom form. The custom form and the message format are tailor-made for each other.
    4. The attacker sends the trigger email to the compromised mailbox, which is still being used as normal by the unsuspecting user.
    5. When the mailbox receives the message, the mailbox loads the required form. The form launches an application on a remote (WebDAV) server.
    6. Typically, the application installs malware on the user's machine (for example, PowerShell Empire).
    7. The malware allows the attacker to steal (or steal again) the user's username and password or other credentials from local machine and perform other malicious activities.

What a rules and custom forms injection attack might look like in Office 365

Use the following steps to inspect a user's Outlook rules for signs of compromise.

  1. Open the users Outlook client as the user. The user maymight need your help in examining the rules on their mailbox.

  2. Refer to Manage email messages by using rules article for the procedures on how to open the rules interface in Outlook.

The best way to protect user accounts (especially admin accounts) is to set up multifactor authentication for Microsoft 365 users. You should also:

  • Monitor how user accounts are accessed and used by using Microsoft Entra monitoring and health. You maymight not prevent the initial breach, but you can shorten the duration and the effects of the breach by detecting it sooner. You can use these Office 365 Cloud App Security policies to monitor accounts and alert you to unusual activity:

    • Multiple failed login attempts: Triggers an alert when users perform multiple failed sign in activities in a single session with respect to the learned baseline, which could indicate an attempted breach.

Customers with on-premises Exchange installations should consider blocking older versions of Outlook that don't have patches available. For details on blocking older Outlook versions, see Configure Outlook client blocking.

See alsoRelated content

The following resources provide additional detail on the attack techniques and tools discussed in this article.

  • Malicious Outlook Rules by SilentBreak Security Post about Rules Vector provides a detailed review of how the Outlook Rules.
  • MAPI over HTTP and Mailrule Pwnage on the Sensepost blog about Mailrule Pwnage discusses a tool called Ruler that lets you exploit mailboxes through Outlook rules.