The user said some of his finance emails were “just disappearing.” At first, I thought maybe he was accidentally moving them or Outlook was syncing badly. His laptop looked clean, Defender was quiet, and there was nothing obvious running on the endpoint. So I stopped looking at the laptop and checked the mailbox itself. That was where I found a rule called: RSS Feed Cleanup The name did not look serious at all. But when I opened the rule properly, it was looking for emails with words like: invoice and payment Then it would mark those emails as read and move them straight into the RSS Subscriptions folder. So the messages were actually being delivered. The user just was not seeing them in his Inbox. I checked mailbox-level forwarding next, thinking maybe somebody was also forwarding mail outside the company. Nothing there. Then I checked the Microsoft 365 audit logs. The rule had been created around 9:16 PM the previous night and modified again less than a minute later. That was definitely not something the user remembered doing. Now we had a different type of incident. The attacker was not trying to destroy the mailbox. They were trying to quietly control what the user could see. And if you think about finance-related emails, that can become very serious very quickly. If somebody can hide legitimate invoices or payment conversations, they can create room for fake payment instructions later without the victim seeing the original thread properly. We disabled the rule, revoked the user’s active sessions, reset the credentials and started reviewing the sign-in history and OAuth permissions. We also checked whether any similar rules had been created in other mailboxes. What stood out to me here was that the laptop was not the problem. You can rebuild the laptop completely and still miss an incident like this if the persistence or manipulation is sitting in the cloud account. Sometimes when a user says, “My emails are disappearing,” it is worth checking more than Outlook. Check the mailbox rules too. That small rule can tell you a lot.