Alert: Outbound message contains malware triggers for incoming external mails

%3CLINGO-SUB%20id%3D%22lingo-sub-263299%22%20slang%3D%22en-US%22%3EAlert%3A%20Outbound%20message%20contains%20malware%20triggers%20for%20incoming%20external%20mails%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-263299%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20configured%20a%20policy%20to%20alert%20me%20when%20an%20outbound%20message%20contains%20malware.%20but%20this%20rule%20constantly%20fires%20on%20incoming%20Messages%2C%20which%20I%20don't%20understand%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20the%20rule%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%222018-09-27_screenshot_001.png%22%20style%3D%22width%3A%20581px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F54726iC183AB8B369D42CE%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222018-09-27_screenshot_001.png%22%20alt%3D%222018-09-27_screenshot_001.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20here%20is%20the%20message%20I%20receive%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%222018-09-27_screenshot_002.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F54728i84963C9EE50BBD70%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222018-09-27_screenshot_002.png%22%20alt%3D%222018-09-27_screenshot_002.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-263299%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Valued Contributor

I have configured a policy to alert me when an outbound message contains malware. but this rule constantly fires on incoming Messages, which I don't understand:

 

Here is the rule:

2018-09-27_screenshot_001.png

 

And here is the message I receive

2018-09-27_screenshot_002.png

0 Replies