ORCA.179 - Safe Links is enabled intra-organization.
Overview
Phishing attacks are not limited from external users. Commonly, when one user is compromised, that user can be used in a process of lateral movement between different accounts in your organization. Configuring Safe Links so that internal messages are also re-written can assist with lateral movement using phishing. The built-in policy is ignored in this check, as it only provides the minimum level of protection.
Remediation action
Enable Safe Links between internal users.
Related Links
- Microsoft 365 Defender Portal - Safe links
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.179 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1534 Internal Spearphishing, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA179 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.179.ps1 - Documentation:
tests/orca/Test.ORCA.179.md