## Based on https://github.com/Scine/Office365/blob/master/Display%20Name%20Spoofing%20365.ps1
Connect-ExchangeOnline
While([String]::IsNullOrWhiteSpace($domain)){
$domain = Read-Host -Prompt 'User domain (domain.com)'
}
$ruleName = "External Senders with matching Display Names"
$rule = Get-TransportRule | Where-Object {$_.Identity -contains $ruleName}
$displayNames = (Get-Mailbox | Where {$_.EmailAddresses -like "*@$domain"}).DisplayName
if (!$rule) {
Write-Host "Rule not found, creating rule" -ForegroundColor Green
New-TransportRule -Name $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true
}
else {
Write-Host "Rule found, updating rule" -ForegroundColor Green
Set-TransportRule -Identity $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true
}