ORCA.112 - Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.
Overview
When the sender email address is spoofed, the message appears to originate from someone or somewhere other than the actual source. With Standard security settings it is recommended to configure Anti-spoofing protection action to Move message to the recipients' Junk Email folders in Office 365 Anti-phishing policies.
Remediation action
Configure Anti-spoofing protection action to Move message to the recipients' Junk Email folders in Anti-phishing policy.
Related Links
- Configuring the anti-spoofing policy
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.112 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA112 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.112.ps1 - Documentation:
tests/orca/Test.ORCA.112.md