How can I block the content of emails that are encoded in base64?

Question

My question is exactly the title. I need to block emails that are sent/received with their content encoded in base64.

I put some rules in Microsoft Purview, with regex, but it always gives a lot of false positives. Can anyone help me, if they have already implemented this policy for blocking base64 encoded messages?

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

I'm hopeful this proves helpful to you:

• In the Exchange Admin Center, go to Mail flow > Rules and create a new rule.
• Set the rule condition to look for "The subject or body > subject or body matches these text patterns" and enter a regex pattern to detect base64 encoding, such as (?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?.
• Set the action to "Modify the message properties > set the spam confidence level (SCL)" and choose a high SCL value like 9 to mark the message as high confidence spam.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful