How To Warn users for Email Impersonation Phishing mail

25 thoughts on “How To Warn users for Email Impersonation Phishing mail”

1. Hey Frank,

   Thanks for posting updated code.

   I have updated my script but its returning back with the below.

   Creating Impersonation Transport Rule 1 …
   Write-ErrorMessage : |System.InvalidOperationException|The rule can’t be created because it is too large. It has 10623 characters,
   and the maximum number of characters is 8192. Reduce the size, either by removing content, such as words or regular expressions,

2. The linked GitHub script doesnt increment $c to make the rule so Rule 0 gets overwritten

   • Thanks, it should be fixed now.

3. Hello,

   I have a question about the warning banner. Will the banner still remain in the mail conversation when I press reply on an external email?

   • Yes, it’s embedded in the email body.

4. Thank you for this! I have copied and it is working. However, I have one issue. The background highlight doesn’t work all the time. I have tested sending mail to my company email using my gmail and icloud ID. On gmail, it works perfectly but on my icloud mail it gets the disclaimer message but no backgroud color/highlight. Please advise. Thank you

   • It seems that the emails from iCloud are not in HTML format. That is why you don’t see the colors or other styling options.

5. I modified the loop for breaking into multiple transports and tested it.

   Replace the section after else.

   {
   $chunks = [System.Collections.ArrayList]::new()
   for ($i = 0; $i -lt $displayNames.Count; $i += 100) {
   if (($displayNames.Count – $i) -gt 99 ) {
   $chunks.add($displayNames[$i..($i + 99)])
   }
   else {
   $chunks.add($displayNames[$i..($displayNames.Count – 1)])
   }
   }

   $c = 0;
   foreach ($chunk in $chunks) {
   Write-Host “Creating Transport Rule” -ForegroundColor Cyan

   # Create new Transport Rule
   New-TransportRule -Name “$transportRuleName-$C” `
   -FromScope NotInOrganization `
   -SentToScope InOrganization `
   -HeaderMatchesMessageHeader From `
   -HeaderMatchesPatterns $chunk `
   -ApplyHtmlDisclaimerLocation Prepend `
   -ApplyHtmlDisclaimerText $HTMLDisclaimer `
   -ApplyHtmlDisclaimerFallbackAction Wrap

   Write-Host “Transport rule $c created” -ForegroundColor Green
   $c = $c + 1
   }
   }

   • Hello, Amazing script, thanks.

     But there is a little issue with the loop. When i try to restart the script, the update part is not working.
     I’m not a Powershell master user but if i’m understand correctly, the script try to find a rule name “Impersonation warning” but in the loop section change the name for “Impersonation warning-0, -1, -2 …) so the update part of the script can’t find them.

     So for now i’m deleting the 4 rules created by the script and replay it.

     it will be very nice if you can adjust it for a newbie like me 🙂

     But still it is a fantastic script, so thank you for that.

     • Helene, I quickly added this script to do the following:
       1. Export all rules (in case things go wrong) to a file name that will include a Date and Time
       2. Delete all rules that contain “impersonation” in their name

       This is my quick-win script as I couldn’t get the script to update as I’m also not an expert in PowerShell

       #export/backup ALL rules
       $file = Export-TransportRuleCollection
       [System.IO.File]::WriteAllBytes(“I:\temp\Exchange Rules $(((get-date).ToUniversalTime()).ToString(“yyyy-MM-dd_HH-mm”)).xml”, $file.FileData)

       #list all “impersonation” only rules and store them in a variable, then delete all
       $tRules = Get-TransportRule | Where-Object {$_.Name -match ‘Impersonation’}
       $int = 0;
       foreach ($tRule in $tRules) {
       #Start-Sleep -s 2
       Remove-TransportRule -identity “$tRule” -Confirm:$false
       Write-host “$tRule not/deleted…” -ForegroundColor Red
       $int = $int +1
       }

6. This is awesome. Many thanks for the hard work. One question though. What happens when a display name is changed or a new user is added? I assume you would have to run the script to update the rule. I am just thinking if a member of my Team performs the display name change/add a new user without letting me know so I can perform the follow-up action.

   • Yes, you will need to re-run the script, or manually add/remove the user.

7. Hi
   Have copied your script only translated it to swedish, but i keep getting error message
   The rule can’t be created because it is too large. It has 24183 characters, and the maximum number of characters is 8192. Reduce the
   size, either by removing content, such as words or regular expressions, from the rule; or by removing conditions, exceptions, or
   actions from the rule.
   How do you get it to work?
   Whitout it geeting to large

   • How many users do you have? I have tested it with up to 200 users, and that worked fine.

     • We have 600 users roughly

       • I think you will have to break up the list into smaller batches, creating multiple exchange rules.

         Something like this:

         
$chunks = [System.Collections.ArrayList]::new()
for ($i = 0; $i -lt $displayNames.Count; $i += 100) {
if (($displayNames.Count - $i) -gt 99 ) {
$chunks.add($displayNames[$i..($i + 99)])
}
else {
$chunks.add($displayNames[$i..($displayNames.Count - 1)])
}
}

         $c = 0;
         foreach ($chunk in $chunks) {
         Write-Host "Creating Transport Rule" -ForegroundColor Cyan

         # Create new Transport Rule
         New-TransportRule -Name "$transportRuleName-$C" `
         -FromScope NotInOrganization `
         -SentToScope InOrganization `
         -HeaderMatchesMessageHeader From `
         -HeaderMatchesPatterns $chunks `
         -ApplyHtmlDisclaimerLocation Prepend `
         -ApplyHtmlDisclaimerText $HTMLDisclaimer `
         -ApplyHtmlDisclaimerFallbackAction Wrap

         Write-Host "Transport rule $c created" -ForegroundColor Green
}


         I haven’t tested it

         • It wasn’t updating correctly, I made some adjustments

           # Get all existing users
           $displayNames = (Get-EXOMailbox -ResultSize unlimited -RecipientTypeDetails usermailbox).displayname

           # Set the transport rule name
           $transportRuleName = “Impersonation warning”

           $chunks = [System.Collections.ArrayList]::new()
           for ($i = 0; $i -lt $displayNames.Count; $i += 100) {
           if (($displayNames.Count – $i) -gt 99 ) {
           $chunks.add($displayNames[$i..($i + 99)])
           }
           else {
           $chunks.add($displayNames[$i..($displayNames.Count – 1)])
           }
           }

           Write-Host “Started looping displayNames chunks …” -ForegroundColor Cyan
           $c = 1;
           foreach ($chunk in $chunks) {

           # Get existing transport rule
           $existingTransportRule = Get-TransportRule | Where-Object {$_.Name -eq “$transportRuleName $c”}

           if ($existingTransportRule)
           {
           Write-Host “Updating Transport Rule $c …” -ForegroundColor Cyan

           # Update existing Transport Rule
           Set-TransportRule -Identity “$transportRuleName $c” `
           -FromScope NotInOrganization `
           -SentToScope InOrganization `
           -HeaderMatchesMessageHeader From `
           -HeaderMatchesPatterns $displayNames `
           -ApplyHtmlDisclaimerLocation Prepend `
           -ApplyHtmlDisclaimerText $HTMLDisclaimer `
           -ApplyHtmlDisclaimerFallbackAction Wrap

           Write-Host “Transport rule $c updated.” -ForegroundColor Green
           }
           else
           {
           Write-Host “Creating Transport Rule $c …” -ForegroundColor Cyan

           # Create new Transport Rule
           New-TransportRule -Name “$transportRuleName $c” `
           -FromScope NotInOrganization `
           -SentToScope InOrganization `
           -HeaderMatchesMessageHeader From `
           -HeaderMatchesPatterns $displayNames `
           -ApplyHtmlDisclaimerLocation Prepend `
           -ApplyHtmlDisclaimerText $HTMLDisclaimer `
           -ApplyHtmlDisclaimerFallbackAction Wrap

           Write-Host “Transport rule $c created.” -ForegroundColor Green
           }
           $c++
           }

           Write-Host “Finished looping displayNames chunks.” -ForegroundColor Cyan

   • Did the extra script work for 200+ users? – thanks

8. Woo hoo! Thank you so much. This is now working! I’m going to keep following you to see what else I can learn. Thanks again!

9. Ok, I do have that option! It wasn’t available to me because I had used 2 conditions to apply the rule already – apply the rule if the sender is located outside the organization and the recipient is located inside the organization. If I get rid of that second condition which really isn’t needed, I see where I can choose Header. Thank you!

10. Unfortunately, I’m lost on this part. I don’t have the option to change the sender’s specified properties to Header. I’m using the rules on the Exchange admin center and only have certain options I can pick from. Under the sender’s specified properties match these text patterns, I can select user properties, and DisplayName is one of them but there’s nothing about header.

    I think you’re using a program that perhaps I don’t have?

    • You don’t have the option > A message header? And then “matches these text patterns”? You can then click on “Enter text..” and type “from”
      See this screenshot

11. Is it possible to create this rule in the exchange admin center, rather than use Power Shell? We often get random email addresses using only certain names as Display Names.

    I created a warning within the rules, just like I did for external emails (following one of your articles, and it worked). Apply this rule if the sender is located outside the organization, and the recipient is located inside the organization and the sender’s specified properties includes any of the these words… Display Name XXXX or Display Name XXXX or Display Name XXXX (I listed out about 10). Then, do the following – prepend the disclaimer –

    ‘ Caution: This email originated from outside the organization AND has the same display name as someone inside our organization. This is probably a phishing email. Do not click on links, open attachments, or follow any instructions in this email. ‘; and fall back to action Wrap if the disclaimer can’t be inserted.

    Do you see something that I’m doing wrong? Thanks very much

    • Change this: the sender’s specified properties include any of these words
      To: A Message header matches > specify From > Add the display name

      You can also run the script, and change $displayNames = (Get-EXOMailbox -ResultSize unlimited -RecipientTypeDetails usermailbox).displayname to $displayNames = “Place Holder”

      This way the rule will be created in Exchange Online, allowing you to change the display names manually later on.

12. Thanks for posting this article! I really appreciate it!