8.7 Transport Rules for Security

Transport Rules for Security

By the end of this subsection, you will know the most effective transport rules for email security, understand how the Module 13 transport rules blocked Waves 4-5, and be able to create rules for your environment.

Transport rules (also called Exchange mail flow rules or Exchange Online protection rules in some documentation) process every email that flows through Exchange Online. They evaluate conditions and take actions before the email reaches the user’s mailbox — making them a powerful pre-delivery security control.

The four essential security transport rules

The Module 13 transport rules — how they blocked Waves 4-5

In Module 13, three transport rules were deployed during the incident:

Rule 1: URL pattern block. Condition: message body or URL matches /auth/[a-f0-9]{32}/login. Action: reject with NDR explaining the block. This caught the phishing kit’s URL structure regardless of which domain it was deployed on. Waves 4 and 5 used new domains but the same URL pattern — blocked before delivery.

Rule 2: External sender banner. Condition: sender is external. Action: prepend HTML banner. Users reported this helped identify Wave 5’s “project update” lure as external when the subject line implied internal communication.

Rule 3: Lookalike domain block. Condition: sender domain contains “northgate” AND sender is external. Action: reject. Caught all future domains matching the attacker’s naming pattern.

Creating the URL pattern block rule

1. Navigate to Exchange admin center -> Mail flow -> Rules -> Add a rule
2. Condition: “The subject or body includes” -> enter the URL pattern
3. For regex patterns: use “The subject or body matches text patterns” -> enter the regex
4. Action: Reject the message with the explanation -> “This email was blocked by a security transport rule. Contact IT if you believe this is an error.”
5. Exceptions: None (or add specific senders if needed)
6. Priority: Set high (lower number = higher priority)

Attachment type blocking rule

Block executable attachment types that have no legitimate business purpose in email:

Blocked file types: .exe, .scr, .bat, .cmd, .ps1, .vbs, .js, .wsf, .hta, .com, .pif, .reg

Configuration: Exchange admin center -> Mail flow -> Rules -> “Block dangerous attachment types” -> Condition: Any attachment file extension includes [list above] -> Action: Reject message with explanation.

Monitoring transport rule effectiveness

1
2
3
4
5
6
7
8
9

// Check which transport rules are firing and how often
EmailEvents
| where TimeGenerated > ago(30d)
| where DeliveryAction == "Blocked"
| where DetectionMethods has "Transport rule"
| summarize BlockCount = count(), UniqueRecipients = dcount(RecipientEmailAddress)
    by Subject = tostring(split(Subject, " ")[0]), SenderMailFromDomain
| sort by BlockCount desc
| take 10