Detections
Analytics

2.1.2 Ensure the Common Attachment Types Filter is enabled

Information

The Common Attachment Types Filter is a setting within Exchange Online Protection's anti-malware policy that blocks inbound and outbound email messages containing attachments of specified file types. When enabled, messages with attachments matching the blocked extensions are quarantined before delivery. Microsoft maintains a default set of file types considered high risk; organizations may also add custom extensions to the list.

The recommended state is Enable the common attachments filter set to On, on the default anti-malware policy, with the default list of blocked file types.

Email is a primary delivery vector for malware, including ransomware, trojans, and remote access tools distributed via executable, script, and installer file formats. The Common Attachment Types Filter blocks delivery of file types that have no legitimate business use in email but are routinely weaponized (such as .exe, .vbs, .bat, .msi ), and similar formats. Enforcing this filter at the gateway reduces the attack surface before any client-side or endpoint control has the opportunity to respond.

Solution

To remediate using the UI:

 - Navigate to Microsoft Defender https://security.microsoft.com.
 - Expand Email & collaboration > Policies & rules.
 - On the Policies & rules page select Threat policies.
 - Under polices select Anti-malware and click on the Default (Default) policy.
 - On the Policy page that appears on the right hand pane scroll to the bottom and click on Edit protection settings, check the Enable the common attachments filter.

 - If any of the default file types are missing click Select file types and add the missing file types in.
 - Reference the Default Value section of this document for the list of extensions that should be blocked.

 - Click Save to save the changes.

To remediate using PowerShell:

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following to enable the common attachment filter:

Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true

 - Use Set-MalwareFilterPolicy -Identity Default with the -FileTypes parameter to add any missing file types from the default list.

 - FileTypes accepts an array of strings.
 - To avoid using it destructively, first retrieve the existing list of file types using Get-MalwareFilterPolicy and append any missing file types to the list before using Set-MalwareFilterPolicy to update the policy.

Impact:

Emails containing attachments with blocked extensions, including those sent by trusted internal senders, will be quarantined and not delivered. Some file types in the default block list may be used legitimately in some IT workflows. Administrators who need to permit specific extensions for specific users or groups should create a scoped custom anti-malware policy with a higher priority than the Default policy rather than modifying the Default policy's file type list.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, 800-53|SI-8, CSCv7|7.9, CSCv7|8.1

Plugin: microsoft_azure

Control ID: 161efc9bd0b6189716c4c2261d2e16240da82a7c46f482e660c579b60e7a67bc