ORCA.120.2 - Zero Hour Autopurge Enabled for Malware.
Overview
Zero Hour Autopurge can assist removing false-negatives post detection from mailboxes. By default, it is enabled.
Remediation action
Enable Zero Hour Autopurge.
Related Links
- Microsoft 365 Defender Portal - Anti-malware
- Recommended settings for EOP and Microsoft Defender for Office 365 security
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.120.2 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Zero-hour auto purge |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.001 Spearphishing Attachment |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA120_malware |
| Services | ExchangeOnline |
Source
- Test:
tests/orca/Test.ORCA.120.2.ps1 - Documentation:
tests/orca/Test.ORCA.120.2.md