Powershell : Exchange Transport Rules with a wordlist


I had a requirement the other week to create a wordlist block in the form of a Transport rule which will block messages based on a keyboard in the subject or body from outside the company.

This is pretty simple to complete, but what if that list is 500 words or more, I did not like the idea of manually adding each word to a ruleset so this is where Powershell can save you from lots of manual administrative effort.

This is that wordlist save to a file as "wordlist.txt" as you can see below:


We now need to format all these words into a list so that it can be used in a transport rule, so this required some formatting from Powershell, this is the script:

Script : WordsConvertor.ps1

This script will take the wordlist.txt, apply the correct formatting to this list and then export it ot TransportWords.txt

$inputFile = "Wordlist.txt"
$outputFile = "TransportWords.txt"

$words = Get-Content -Path $inputFile
$wordString = "'{0}'" -f ($words -join "','")

$output = "`$Keywords = @($wordString)"
$output | Out-File -FilePath $outputFile

The output of this will be a transport rule friendly format as you can see below:

$Keywords = @('Grizzly','Kodiak','Panda','Polar','Black','Brown','Claw','Fur','Paw','Roar','Hibernate','Cave','Forest','Salmon','Honey','Bamboo','Cubs','Den','Wild','Mammal','Furry','Predator','Climber','Growl','Alaska','Canada','Tundra','Omnivore','Wilderness','Cozy','Snout','Woodland','Prowl','Grazing','Beast','Massive','Quiet','Hunting','Feral','Gentle','Shaggy','Alaskan','Ursine','Solitude','Arboreal','Lair','Tracks','Pelt','Skull','Bone','Evil','Sorcerer','Mystic','Staff','Magic','Villain','Castle','Power','Dark','Shadow','Phantom','Cloak','Cackle','Demonic','Doom','Curse','Warrior','Undead','Necro','Dagger','Shadowy','Master','Grim','Wraith','Terror','Ruin','Wrath','Cursed','Malevolent','Shroud','Fear','Haunt','Chilling','Enigma','Shrieking','Ancient','Sinister','Malice','Agony','Dread','Mysterious','Sorcery','Eldritch','Fiend','Lurking','Realm','Hollow','Skeletal','Savage','Stalker','Beastly','Alpha','Frenzy','Lurk','Chaos','Veil','Shiver','Totem','Abyss','Ritual','Howl','Cold','Death','Throne','Mask','Immortal','Fangs')

Now you can take this wordlist and apply this to a transport rule created in Powershell as below:

Script : WordListTransportRule.ps1

# Connect to Exchange Online
Connect-ExchangeOnline

# Create array of keywords
$Keywords = @('Grizzly','Kodiak','Panda','Polar','Black','Brown','Claw','Fur','Paw','Roar','Hibernate','Cave','Forest','Salmon','Honey','Bamboo','Cubs','Den','Wild','Mammal','Furry','Predator','Climber','Growl','Alaska','Canada','Tundra','Omnivore','Wilderness','Cozy','Snout','Woodland','Prowl','Grazing','Beast','Massive','Quiet','Hunting','Feral','Gentle','Shaggy','Alaskan','Ursine','Solitude','Arboreal','Lair','Tracks','Pelt','Skull','Bone','Evil','Sorcerer','Mystic','Staff','Magic','Villain','Castle','Power','Dark','Shadow','Phantom','Cloak','Cackle','Demonic','Doom','Curse','Warrior','Undead','Necro','Dagger','Shadowy','Master','Grim','Wraith','Terror','Ruin','Wrath','Cursed','Malevolent','Shroud','Fear','Haunt','Chilling','Enigma','Shrieking','Ancient','Sinister','Malice','Agony','Dread','Mysterious','Sorcery','Eldritch','Fiend','Lurking','Realm','Hollow','Skeletal','Savage','Stalker','Beastly','Alpha','Frenzy','Lurk','Chaos','Veil','Shiver','Totem','Abyss','Ritual','Howl','Cold','Death','Throne','Mask','Immortal','Fangs')

# Create transport rule
New-TransportRule `
    -Name "Bear/Skeletor ReDirect Rule" `
    -From "naughty.bear@croucher.cloud","evil.bear@croucher.cloud" `
    -SubjectOrBodyContainsWords $Keywords `
    -RedirectMessageTo "nobears@croucher.cloud" `
    -Enabled $false

# Verify rule status
Get-TransportRule "Bear/Skeletor ReDirect Rule" | Select-Object Name, State

This will then create your Transport rule which will be disabled, once you have check this you can then enable your transport rule.
Previous Post Next Post

نموذج الاتصال