ORCA.118.2 - Domains are not being allow listed in an unsafe manner in Transport Rules.
Overview
Emails coming from allow listed domains bypass several layers of protection within Exchange Online Protection. If domains are allow listed, they are open to being spoofed from malicious actors.
Remediation action
Remove allow listed domains.
Related Links
- Exchange admin center in Exchange Online
- Using Exchange Transport Rules (ETRs) to allow specific senders
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.118.2 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA118_2 |
| Services | ExchangeOnline |
Source
- Test:
tests/orca/Test.ORCA.118.2.ps1 - Documentation:
tests/orca/Test.ORCA.118.2.md