5

I'm trying to set up a filter rule in Microsoft Exchange Online via the web interface (Office365 Admin Center > Exchange Admin Center > Mail Flow / Rules).

I want to match the "sender address" against known addresses that are "inside the organization" so as to detect incoming phish/whale delivery.

A dialog "specify words or phrases" appears, inviting me to enter the strings to match against:

enter image description here

Contextual help is sadly missing. However, according to Mail flow rule conditions and exceptions (predicates) in Exchange 2016 I can use regular expressions in the entry box :

Extract from Microsoft webpage

But which regular expressions exactly? Perl?

David Tonhofer
  • 960
  • 1
  • 10
  • 31
  • great question - I was wondering the same, and your link put me in the right direction. I turned my comment into an answer as the other 2 at this time are incorrect. Thanks again for the link. – Hicsy Sep 21 '20 at 12:08

4 Answers4

6

You're right that the documentation there is a little light. However, EAC is just a UI for the PowerShell commands that get run.

So, the real question is "What regular expressions does PowerShell support?"

RegEx is supported and in the case of "The Sender address matches..." this would be a -match expression. So, you could put something like this into that box [a-z]+ to match any character from a to z. This is just an idea to get you going since you didn't say exactly what kind of match you wanted to make.

Slipeer
  • 3,295
  • 2
  • 21
  • 33
Ken Johnson
  • 76
  • 2
3

You're in the right location...

Just enter a regular expression.
There a handy utility available at: http://regexhero.net/tester/

enter image description here

ewwhite
  • 197,159
  • 92
  • 443
  • 809
2

As you pointed out, the table under the "SENDERS" heading suggests that the property type used is: "Patterns". This is defined later in that same document.

If you scroll down further on that page to the heading "PROPERTY TYPES" and look under Patterns:

enter image description here

This will link you to the exact definition of Microsoft's Regular Expression Syntax.
Current RegEx Link as of 2020-SEP-21

Hicsy
  • 130
  • 4
0

Here are other sites to learn and test regex :

• https://regex101.com/

• https://regexr.com/

• http://regexstorm.net/tester

• https://regexlib.com/RETester.aspx

As a reference: https://download.microsoft.com/download/D/2/4/D240EBF6-A9BA-4E4F-A63F-AEB6DA0B921C/Regular%20expressions%20quick%20reference.pdf

An internal email address such as John.Doe@contoso.com would be detected by (?i:contoso.com) Wouldn't it?

Franck
  • 1