Detects inbound email messages where the mailer header claims to be Microsoft Outlook but the header does not conform to the expected build version format, indicating the header value may be spoofed or fabricated. The rule triggers when the inbound data contains headers.mailer starting with "Microsoft Outlook, Build" and the value fails to match the canonical pattern "Microsoft (?:Office )?Outlook, Build \d{1,2}\.0\.\d{4,5}". This implies impersonation or brand spoofing of the Outlook client used in the mailer header to mislead recipients and bypass simple checks. By focusing on header analysis, it aims to catch vanity or misleading client identifiers that could accompany Spam, Credential Phishing, or BEC/Fraud attempts. Limitations include reliance on a single header field (which attackers may spoof consistently) and lack of validation for other email authentication signals (DKIM/SPF/DMARC). The rule is best used alongside other anti-spoofing controls that assess multi-factor provenance of inbound mail and message integrity.