<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-gateway-rules
description: >-
  Configure and manage email security gateway rules for phishing defense.
  Covers transport rules, content filtering, attachment policies, URL
  rewriting, external sender tagging, and quarantine management across
  Microsoft 365, Google Workspace, and Proofpoint.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - email-gateway
  - transport-rules
  - content-filtering
  - url-rewriting
  - quarantine
  - microsoft-365
  - proofpoint
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Implementing Email Gateway Rules

## Overview

Email security gateways are the primary defensive layer against phishing. This skill
covers creating transport rules, content filtering policies, attachment blocking,
URL rewriting and sandboxing, external email tagging, and quarantine workflows
across major platforms (Microsoft 365 Defender for Office 365, Google Workspace,
and Proofpoint).

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| M365 PowerShell | `Install-Module ExchangeOnlineManagement` |
| Google Admin SDK | Workspace admin access |
| Gateway admin access | Proofpoint/Mimecast console |

## Key Concepts

### Defense-in-Depth Email Stack

```
Internet → MX Record
├── Layer 1: Email Gateway (Proofpoint/Mimecast/M365)
│   ├── Connection filtering (IP reputation, RBL)
│   ├── Authentication (SPF/DKIM/DMARC enforcement)
│   ├── Content filtering (spam scoring, phishing heuristics)
│   ├── Attachment sandboxing (detonate before delivery)
│   └── URL rewriting (time-of-click protection)
├── Layer 2: Transport Rules
│   ├── External email tagging ([EXTERNAL] banner)
│   ├── Executive impersonation detection
│   ├── Attachment type blocking (.exe, .iso, .lnk)
│   └── Sensitive keyword alerting
├── Layer 3: Mailbox-Level
│   ├── Safe Attachments policy
│   ├── Safe Links policy
│   └── Anti-phishing policy (impersonation protection)
└── Layer 4: User
    ├── Report phishing button
    └── Security awareness training
```

### Rule Priority Matrix

| Rule Type | Priority | Action |
|---|---|---|
| Block dangerous attachment types | P1 — Critical | Reject |
| DMARC enforcement (p=reject) | P1 — Critical | Reject |
| External email banner | P2 — High | Prepend header |
| Executive name impersonation | P2 — High | Quarantine |
| URL rewriting | P2 — High | Rewrite |
| Suspicious keyword patterns | P3 — Medium | Flag + deliver |
| New domain sender (< 30 days) | P3 — Medium | Add warning |

## Workflow

### 1. External Email Tagging

```bash
# M365: Create transport rule for external email banner
# New-TransportRule -Name "External Email Banner" \
#   -FromScope NotInOrganization \
#   -ApplyHtmlDisclaimerLocation Prepend \
#   -ApplyHtmlDisclaimerText '<div style="background:#ffd700;padding:8px;border:1px solid #e6c200;font-weight:bold;">⚠️ EXTERNAL: This email originated outside the organization. Exercise caution with links and attachments.</div>' \
#   -ApplyHtmlDisclaimerFallbackAction Wrap

# Generate rule configuration
node agent.js generate-rule --type external-banner
```

### 2. Attachment Blocking

```bash
# Block dangerous attachment types
# New-TransportRule -Name "Block Dangerous Attachments" \
#   -AttachmentExtensionMatchesWords "exe","bat","cmd","ps1","vbs","wsf","js","iso","img","lnk","scr","dll","hta" \
#   -RejectMessageReasonText "Blocked: Dangerous attachment type"

# Generate attachment policy
node agent.js generate-rule --type block-attachments

# List current rules
node agent.js list-rules --platform m365
```

### 3. URL Rewriting and Safe Links

```bash
# M365 Safe Links policy
# New-SafeLinksPolicy -Name "Company Safe Links" \
#   -EnableSafeLinksForEmail $true \
#   -ScanUrls $true \
#   -DeliverMessageAfterScan $true \
#   -EnableForInternalSenders $true \
#   -TrackClicks $true

node agent.js generate-rule --type safe-links
```

### 4. Quarantine Management

```bash
# Review quarantined messages
# Get-QuarantineMessage -PageSize 50 -StartDate (Get-Date).AddDays(-7)

# Release false positive
# Release-QuarantineMessage -Identity <MessageId> -ReleaseToAll

# Generate quarantine report
node agent.js quarantine-report --days 7
```

## Detection

```yaml
title: Email Gateway Rules Detection
id: 870e1c19-62e1-4575-bbee-6fb2a54e3976
status: experimental
description: Detects suspicious activity related to implementing email gateway rules techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| External banner active | Send test email from external account |
| Attachment blocking works | Send test with `.exe` attachment |
| URL rewriting active | Send email with URL, verify rewrite |
| DMARC enforcement | Send spoofed email, verify rejection |
| Quarantine operational | Review quarantine queue, test release |
| Impersonation rules active | Send email with executive display name |

## References

- [Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/)
- [Exchange Transport Rules](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
- [Google Workspace Email Security](https://support.google.com/a/answer/2368132)
- [Proofpoint Email Protection](https://www.proofpoint.com/us/products/email-security-and-protection)
