Anomalous Exchange AuthAs Header (Ghost-Sender Exploit)

Ethan Andrews@eandrews

•updated Jun 9, 2026•5•0•28

Identifies emails where the sender claims to be internal, but the X-MS-Exchange-Organization-AuthAs header is not set to 'Internal', indicating a potential Ghost-Sender exploit. This rule focuses on delivered emails to reduce noise and filters out expected external mail gateways and trusted automated senders.