Yes that header is added very late.  Try using the spamdetect header instead.  (match on the number of *'s)

    ChrisP.

Problem resolved. The email address I was sending the test from was in the recipients whitelist. Once I removed this the rule worked as expected.

I tried to setup another rule as follows

If the CUSTOM --> X-SPAM-FLAG header contains Yes
then Reject

This doesn't seem to work on emails where X-SPAM-FLAG: YES. Does the X-SPAM-FLAG header get added after the email has passed through the exceptions and filter rules?