🧰 Immediate Actions to Take
[Office admin permissions required] Reset person's password immediately.
[Office admin permissions required] Revoke all active sessions via Microsoft 365 Admin Center: Force Sign-out of All Devices in Microsoft 365 Portal
Remove unauthorized MFA methods and re-register trusted ones.
Check for Malicious Inbox Rules in Outlook Online.
Context: Attackers often create hidden or subtle inbox rules to exfiltrate, hide, or delete emails. One common sign of compromise is a rule like:
"Mark email as read and move from Inbox to RSS Subscriptions (RSSFeeds)"
These rules are used to silently redirect legitimate emails away from the user's main view, allowing the attacker to operate undetected.
Action Steps:
Access Outlook Online:
Visit Outlook Web App and log in with the compromised account credentials.
Navigate to Inbox Rules:
Click the Settings gear icon (⚙️) in the top-right corner.
Select "View all Outlook settings" at the bottom.
Go to Mail > Rules.
Review All Rules:
Carefully inspect all listed rules. Look for any that:
Move mail to RSS Subscriptions, Junk, Deleted Items, or Archive.
Automatically mark messages as read.
Apply to all messages or have vague conditions.
Examples of Suspicious Rules:
"Apply to all messages > Mark as read > Move to RSS Subscriptions"
"If subject contains 'invoice' > Delete the message"
"From: anyone > Move to Archive"
Delete Suspicious Rules:
If a rule seems unfamiliar or malicious, delete it immediately.
Document the rule (e.g. screenshot) before deletion for incident reporting.