Regular Expressions in Office 365 Mail Flow Rule

Question

I'm attempting to use a regular expression mail flow rule to match inbound email pretending to be executives with my company, in Office 365 Exchange. However, I'm struggling to find what regex is accepted by the rule, and also make it broad enough to catch any domain.

I have the following items set on a test rule:

• Apply this rule if... The sender is located - Outside the organization
• Generate incident report and send it to - me
• Priority = 1
• Audit this rule with severity level: Low (Enabled)
• Mode for this rule: Enforce

As to the regex I am using the option "The sender address matches..." and assuming my test executive is "Foo Bar", the regex is

foo\s*bar.*@.*\.\w*

I created a gmail account "Foo Bar, [email protected]" and sent test emails to my work account, but I'm not getting an incident report sent to me.

Is the issue with my regex, or some other setting in the Exchange rule?

Answer 1

I also found that the regex expression itself in the Mail Flow rules are pretty particular as to the language type reference. What may work in C# wasn't always transferrable into the Mail Flow rule editor for the regex expression. I used https://regex101.com/ to compile what should work and then used the "Code Generator" tool, then selected "AutoIt" as the language. The expression within the window worked flawlessly in the Mail Flow Rule.

Example: I wanted a specific signature added (as we apply via mail flow) on replies or forwards; regex:

(^(?!RE:))(^(?!FW:)) 

when using the AutoIt code:

'(?im)(^(?!RE:))(^(?!FW:))'