CIS.M365.7.3.1 - (L2) Ensure Office 365 SharePoint infected files are disallowed for download
Overview
7.3.1 (L2) Ensure Office 365 SharePoint infected files are disallowed for download
By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.
Rationale
Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.
Impact
The only potential impact associated with implementation of this setting is potential inconvenience associated with the small percentage of false positive detections that may occur.
Remediation
PowerShell
- Connect to SharePoint Online using
Connect-SPOService -Url https://tenant-admin.sharepoint.com, replacing "tenant" with the appropriate value. - Run the following PowerShell command to set the recommended value:
Set-SPOTenant -DisallowInfectedFileDownload $true
Note: The Global Reader role cannot access SharePoint using PowerShell according to Microsoft. See the reference section for more information.
Default Value: False
Related Links
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365
- Overview of external sharing in SharePoint and OneDrive in Microsoft 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 496
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Related products | Defender |
| Feature | Access control |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1080 Taint Shared Content, T1204.002 Malicious File |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.3.1 |
| Benchmark level | L2 |
| Benchmark profiles | E5 Level 2 |
| Supports controls | cis-m365:7.3.1, nist-800-53-r5:SI-3 |
| PowerShell test | Test-MtCisSpoPreventDownloadMaliciousFile |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.3.1.md