## Based on https://github.com/Scine/Office365/blob/master/Display%20Name%20Spoofing%20365.ps1



Connect-ExchangeOnline


While([String]::IsNullOrWhiteSpace($domain)){

    $domain = Read-Host -Prompt 'User domain (domain.com)'

}


$ruleName = "External Senders with matching Display Names"


$rule = Get-TransportRule | Where-Object {$_.Identity -contains $ruleName}

$displayNames = (Get-Mailbox | Where {$_.EmailAddresses -like "*@$domain"}).DisplayName


if (!$rule) {

    Write-Host "Rule not found, creating rule" -ForegroundColor Green

    New-TransportRule -Name $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true

}

else {

    Write-Host "Rule found, updating rule" -ForegroundColor Green

    Set-TransportRule -Identity $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true

}