ORCA.189.2 - Safe Links is not bypassed.
Overview
Microsoft Defender for Office 365 Safe Links can help protect against phishing attacks by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. The protection can be bypassed using mail flow rules which set the X-MS-Exchange-Organization-SkipSafeLinksProcessing header for email messages.
Remediation action
Remove mail flow rules which bypass Safe Links.
Related Links
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.189.2 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA189_2 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.189.2.ps1 - Documentation:
tests/orca/Test.ORCA.189.2.md