DLP for Bitcoin Addresses
One of the up-and-coming combination phish-ransom attacks is to trick the mark into thinking that you've got access to their data, and then get them to send money to a Bitcoin address to protect them from data leakage. You can create a DLP rule in the Office 365 Security & Compliance Center (or an Exchange Online transport rule) to try to combat this.
The regular expression we're going to work with is:
(bc1|[13])[a-km-zA-HJ-NP-Z1-9]{25,34}(\s|$|\.(?!\w))
This will match the standard BTC addresses (beginning with bc1 or a 1 or a 3), and then 25-34 alphanumeric characters excluding lookalikes (lowercase L, uppercase i, numeral 0 and uppercase o), followed by a space character (\s), the end-of-line ($), or a period (as long as it didn't have any characters immediately after it).
To configure the Security & Compliance DLP sensitive information type, follow these steps.
Security & Compliance Center
Launch a browser, navigate to protection.office.com, select Classifications and then select Sensitive info types.
Click +Create.
Enter a name and description and click Next.
Click +Add an element.
Select Regular expression from the drop-down, and paste in the regular expression text.
If you want to increase the sensitivity or confidence level, you may want to include supporting elements like btc or wallet keywords and click Next.
Confirm and click Finish.
Click Yes to test your pattern against a file.
Create a file with the following content:
Send BTC payment to address:1JHJnnDp9A92XdjfYkHKyrJ3R99Q72K3X4Upload the file and click Test.
Click Finish.
Once you've created the Sensitive info type, you can use it in DLP policies and labels.