Email Regex Banners

Robust regular expressions and rule examples to help flag and banner suspicious emails. This repository is designed to complement Microsoft 365 (Exchange Online) using mail flow rules that prepend subjects or inject a warning banner—but the regex library is platform‑agnostic and can be used in other gateways, SEGs, and SIEM/SOAR pipelines.

Important: Always whitelist legitimate services and domains used by your organization to avoid false positives.