Detections
Analytics
2.1.6 Ensure Exchange Online Spam Policies are set to notify administrators
Information
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP.Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.
Rationale:
A blocked account is a good indication that the account in question has been breached and an attacker is using it to send spam emails to other people.
Impact:
Notification of users that have been blocked should not cause an impact to the user.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To set the Exchange Online Spam Policies:Navigate to Microsoft 365 Defender https://security.microsoft.com.
Click to expand Email & collaboration select Policies & rules> Threat policies.
Under Policies select Anti-spam.
Click on the Anti-spam outbound policy (default).
Select Edit protection settings then under Notifications
Check Send a copy of outbound messages that exceed these limits to these users and groups then enter the desired email addresses.
Check Notify these users and groups if a sender is blocked due to sending outbound spam then enter the desired email addresses.
Click Save.
To set the Exchange Online Spam Policies correctly using PowerShell:
Connect to Exchange Online using Connect-ExchangeOnline.
Run the following PowerShell command:
$BccEmailAddress = @('<INSERT-EMAIL>')
$NotifyEmailAddress = @('<INSERT-EMAIL>')
Set-HostedOutboundSpamFilterPolicy -Identity Default -BccSuspiciousOutboundAdditionalRecipients $BccEmailAddress -BccSuspiciousOutboundMail $true -NotifyOutboundSpam $true -NotifyOutboundSpamRecipients $NotifyEmailAddress
Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization's tenant then ensure the setting is set as outlined in the highest priority policy listed.
Default Value:
BccSuspiciousOutboundAdditionalRecipients : {}
BccSuspiciousOutboundMail : False
NotifyOutboundSpamRecipients : {}
NotifyOutboundSpam : False
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations E3 L1 v3.0.0
Category: INCIDENT RESPONSE
References: 800-53|IR-1, 800-53|IR-8, CSCv7|7.9, CSCv7|7.10
Plugin: microsoft_azure
Control ID: 87b8b147ce91126556b73cd6f96a436d87e49b9fb8fc6efd9c29871cd3402df8