NotRuler – Turning Offence into Defence

This post introduces NotRuler, an open-source defensive utility to detect Ruler-based abuse of Microsoft Exchange/Outlook by enumerating and parsing client-side rules, custom forms (including VBScript), and homepages across mailboxes (with optional admin impersonation), and provides practical IOCs and detection tips—such as the distinctive 'Ruler' User-Agent and NTLM workstation strings and relevant Windows authentication event IDs—alongside notes on Microsoft mitigations and MFA, enabling responders to identify and triage potential Ruler backdoors at scale.