ORCA.118.4 - Your own domains are not being allow listed in an unsafe manner in Transport Rules.
Overview
Emails coming from allow listed domains bypass several layers of protection within Exchange Online Protection. When allow listing your own domains, an attacker can spoof any account in your organisation that has this domain. This is a significant phishing attack vector.
Remediation action
Remove allow listing on domains belonging to your organisation.
Related Links
- Exchange admin center in Exchange Online
- Using Exchange Transport Rules (ETRs) to allow specific senders
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.118.4 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA118_4 |
| Services | ExchangeOnline |
Source
- Test:
tests/orca/Test.ORCA.118.4.ps1 - Documentation:
tests/orca/Test.ORCA.118.4.md