ORCA.158 - Safe Attachments is enabled for SharePoint and Teams.
Overview
Safe Attachments can assist by scanning for zero day malware by using behavioural analysis and sandboxing techniques. These checks suppliment signature definitions.
Remediation action
Enable Safe Attachments for SharePoint and Teams.
Related Links
- Microsoft 365 Defender Portal - Safe attachments
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.158 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | SharePoint, Teams |
| Feature | Safe Attachments |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1080 Taint Shared Content, T1204.002 Malicious File |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA158 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.158.ps1 - Documentation:
tests/orca/Test.ORCA.158.md