Mailbox Rule Remediation

Attackers who take over a mailbox often add an inbox rule that forwards, hides, or deletes mail so they can keep watching it unnoticed. Mailbox rule remediation deletes the exact inbox rule a malicious detection reports, using the Microsoft integration that reported it. Mailbox rule deletion runs automatically from verdict rules. It is not offered in the case Actions > Remediate dialog.

​

Remediation Actions

• Delete Mailbox Rule — permanently delete the inbox rule from the user’s Microsoft mailbox (irreversible)

​

Turning it on

Automatic deletion needs all of the following:

1. Enable Automated Remediations is on under Settings > Remediation (see Introduction to Remediation).
2. Mailbox Rule Auto Remediation is on under Settings > Remediation > Configuration. It is on by default.
3. The matching verdict rule has Delete Mailbox Rule selected. The option is only available on Malicious verdict rules in the Mailbox Rule category, and it is off on every rule Wirespeed ships.
4. The Microsoft integration that reported the detection is not read-only and has been granted the MailboxSettings.ReadWrite permission. See Microsoft remediation access.

Just before deleting, Wirespeed checks again that the detection is still malicious, that its verdict rule still asks for deletion, and that both settings above are still on. If anything changed, the deletion does not run.

​

Which rules can be deleted

Wirespeed deletes a rule only when it can identify it exactly:

• The detection reports a single mailbox rule, with the mailbox that owns it.
• The rule was created or changed in Outlook or Outlook on the web. Microsoft records these changes with the rule’s identifier. Rules created or changed with PowerShell (New-InboxRule, Set-InboxRule) are recorded without it, so they cannot be deleted automatically.
• The rule belongs to the same Microsoft tenant as the connected integration.

Wirespeed never searches the mailbox for similar rules; it deletes only the rule the detection names.

​

Where results appear

• Case timeline — the deletion and its outcome.
• Detection next steps — a Delete mailbox rule step under Remediate. It is marked done when the rule is deleted, failed when Microsoft refused the deletion, or skipped with a reason when Mailbox Rule Auto Remediation is off or no rule on the detection could be deleted.
• Settings > Remediation — Actions Taken lists each deleted rule by name and mailbox; Actions Blocked lists deletions stopped by a setting.
• The Activity Summary email and the Security Overview report count deleted mailbox rules.

​

Supported integrations

• Microsoft