Phishing email goes through because of an Exchange Transport Rule that cannot be found

Said Amchart 806 Reputation points
2023-05-29T21:11:29.6433333+00:00

Hello everyone,

I have got a Phishing email go through to the user's inbox.

When going to the phishing email Explorer page on Security Center to get more details on why the email was let through, I found the following:

  • Exchange Transport Rule has been applied to this email. I can see the GUID of the rule.

User's image

I have checked the following so far:

  • Get-TransportRule, nothing found using the GUID or by listing all the rules.
  • Safe senders, mail flow rules, or block and allow organizational settings.
  • Anti-Spam, Anti-Phishing and other policies that might have a whitelist.

We couldn't find any setting that would allow the email to pass through.

Is there a way to find where and what is this rule by it's GUID only? Or, what policy and configuration allowed this email to pass to the user although it was detected as a phishing email?

Thank you!

Regards,

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,381 questions
{count} votes

Accepted answer
  1. Konstantinos Passadis 17,456 Reputation points MVP
    2023-05-29T21:24:21.91+00:00

    Hello @Said A !

    Can you run the

    Get-InboxRule -Mailbox user@domain.com -includehidden | Select-object *

    Maybe it is a Hidden rule on a specific Mailbox

    So if you ryn Get-TransportRule with the Guid , it does not return nothing ?

    Please try the command i send you and tell us how it went !

    I hope this helps!

    Kindly mark the answer as Accepted and Upvote in case it helped!

    Regards

    0 comments No comments

2 additional answers

Sort by: Most helpful
  1. Andy David - MVP 145.1K Reputation points MVP
    2023-05-30T00:24:11.3366667+00:00

    Did you check the safe sender list of the user who received the message? Not sure which you checked

    Get-MailboxJunkEmailConfiguration -Identity "<user>"
    

    User's image


  2. Konstantinos Passadis 17,456 Reputation points MVP
    2023-05-30T18:02:01.8633333+00:00

    Hello @Said A !

    DId you run the hidden revealing command ?

    Please see my answer and let us know!

    I hope this helps!

    Kindly mark the answer as Accepted and Upvote in case it helped!

    Regards

    0 comments No comments