ORCA.189 - Safe Attachments is not bypassed.
Overview
Microsoft Defender for Office 365 Safe Attachments assists scanning for zero day malware by using behavioural analysis and sandboxing, supplementing signature definitions. The protection can be bypassed using mail flow rules which set the X-MS-Exchange-Organization-SkipSafeAttachmentProcessing header for email messages.
Remediation action
Remove mail flow rules which bypass Safe Attachments.
Related Links
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.189 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566.001 Spearphishing Attachment, T1204.002 Malicious File |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA189 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.189.ps1 - Documentation:
tests/orca/Test.ORCA.189.md