Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer

calendar Aug 21, 2026  ·
Share on: linkedin copy

Flags inbound messages that spoof the Microsoft Outlook mailer header while containing an 'unsubscribe here' link followed by an alphanumeric reference ID pattern in the body text, a common tactic used to lend spam messages an air of legitimacy. Highly trusted sender domains are excluded from this rule when they pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer"
 2description: "Flags inbound messages that spoof the Microsoft Outlook mailer header while containing an 'unsubscribe here' link followed by an alphanumeric reference ID pattern in the body text, a common tactic used to lend spam messages an air of legitimacy. Highly trusted sender domains are excluded from this rule when they pass DMARC authentication."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and strings.istarts_with(headers.mailer, 'Microsoft Outlook')
 8  and regex.icontains(body.current_thread.text,
 9                      'unsubscribe here[\s\S]{0,120}?reference\s?id:\s*[a-z0-9]{6,}'
10  )
11  
12  // negate highly trusted sender domains unless they fail DMARC authentication
13  and not (
14    sender.email.domain.root_domain in $high_trust_sender_root_domains
15    and coalesce(headers.auth_summary.dmarc.pass, false)
16  )  
17attack_types:
18  - "Spam"
19tactics_and_techniques:
20  - "Social engineering"
21  - "Spoofing"
22detection_methods:
23  - "Content analysis"
24  - "Header analysis"
25id: "5257f3dd-8c5f-50c7-a987-89379dfc4e40"
to-top