MT.1043 - Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains

Contributed by Stefan Wey with Bastien PerezAll contributors →

Overview

Spam confidence level (SCL) SHOULD NOT be set to -1 in mail transport rules with specific domains

Rationale: Allow-listing domains in transport rules bypasses regular malware and phishing scanning, which can enable an attacker to launch attacks against your users from a safe haven domain.

Remediation action

1. Connect to Exchange Online:

Connect-ExchangeOnline

1. View your current transport rules:

Get-TransportRule | Select-Object Name, SetScl

1. For each transport rule that uses SetScl -1, modify it to set SCL to 0 or higher:

Set-TransportRule -Identity "RuleName" -SetSCL 0

1. Verify the changes:

Get-TransportRule | Where-Object { $_.SetScl -eq -1 }

The result should return no rules.

Related links

• Exchange Transport Rules and SCL values
• Spam Confidence Levels (SCL) in Exchange Online
• Microsoft Secure Score - Set SCL to 0 or higher for domains

Test Metadata

Field	Value
Test ID	MT.1043
Severity	Medium
Suite	Maester
Product	Exchange Online
Feature	Mail flow
Area	Email and collaboration protection
Resource type	MailFlowRule
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1566 Phishing
Supports controls	nist-800-53-r5:SI-8
PowerShell test	Test-MtExoSetScl
Services	ExchangeOnline

Source

• Test: tests/maester/exchange/Test.MT.1043.ps1
• Documentation: tests/maester/exchange/Test.MT.1043.md