Headers: Malformed Outlook mailer string

calendar Nov 13, 2026  ·
Share on: linkedin copy

Detects inbound messages where the mailer header claims to be Microsoft Outlook but does not conform to the expected build version format, indicating the header value has been spoofed or fabricated.

Sublime rule (View on GitHub)

 1name: "Headers: Malformed Outlook mailer string"
 2description: "Detects inbound messages where the mailer header claims to be Microsoft Outlook but does not conform to the expected build version format, indicating the header value has been spoofed or fabricated."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.istarts_with(headers.mailer, "Microsoft Outlook, Build")
 8  and not regex.imatch(headers.mailer,
 9                       'Microsoft (?:Office )?Outlook, Build \d{1,2}\.0\.\d{4,5}'
10  )  
11attack_types:
12  - "Spam"
13  - "Credential Phishing"
14  - "BEC/Fraud"
15tactics_and_techniques:
16  - "Spoofing"
17  - "Impersonation: Brand"
18detection_methods:
19  - "Header analysis"
20id: "b3318772-815b-56b4-970b-4bb793f7a6f4"
to-top