{
  "id": "CB-M365-MAIL-021",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-021",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-021.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-021.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-021",
    "title": "Turn on the common attachments filter in every anti-malware policy",
    "finding": {
      "title": "Executable and script attachments are not blocked by file type",
      "description": "Files such as .exe, .cmd or .vbe reach mailboxes as long as no malware signature matches them yet."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online-protection",
      "anti-malware",
      "attachments",
      "file-types"
    ],
    "description": "Every anti-malware policy that applies to users (the default policy, custom policies and the\npreset policies) has the **common attachments filter** turned on (`EnableFileFilter $true`) with\nat least Microsoft's default list of file types, which includes `exe`, `cmd` and `vbe`. Matching\nmessages are rejected with an NDR (`FileTypeAction Reject`) or quarantined (`Quarantine`).\n\nThe filter detects the real file type, not only the extension, for the types that support true\ntype matching. Custom policies are enabled and their recipient conditions do not leave users\nwithout a policy other than the default one.\n",
    "rationale": "Executables, scripts, installers and disk images have no place in normal email and are a classic\nfirst stage of malware delivery. Blocking them by type stops new samples that signature scanning\ndoes not know yet, at no cost to legitimate mail.\n",
    "impact": "Users can no longer receive the listed file types by email, also from internal senders. Teams\nthat exchange such files (developers, IT) use SharePoint, OneDrive or another approved channel.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** >\n   **Anti-malware** and open each policy.\n3. Under **Protection settings**, check that **Enable the common attachments filter** is selected,\n   that the file type list contains at least the default types, and that **When these file types\n   are found** is **Reject the message with a non-delivery report (NDR)** or **Quarantine the\n   message**.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-MalwareFilterPolicy | Format-List Name, EnableFileFilter, FileTypeAction, FileTypes\n   Get-MalwareFilterRule | Format-Table Name, State, Priority\n   ```\n5. Fail if a policy that applies to users has `EnableFileFilter` set to `False`, if `FileTypes`\n   lacks `exe`, `cmd` or `vbe` or other default types, or if a custom policy is disabled while\n   users depend on it.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, open the policy > **Edit protection settings**.\n2. Select **Enable the common attachments filter**, keep the default file types (select\n   **Select file types** to add more), choose **Reject the message with a non-delivery report\n   (NDR)** and save.\n3. PowerShell equivalent (Security Administrator):\n   ```powershell\n   Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -FileTypeAction Reject\n   ```\n   Removing types from the list needs `-FileTypes` with the full list; do not remove default types.\n",
      "rollback": "`Set-MalwareFilterPolicy -Identity <policy> -EnableFileFilter $false` (not recommended).\n"
    },
    "references": [
      {
        "title": "Anti-malware protection for email in Microsoft 365",
        "url": "https://learn.microsoft.com/defender-office-365/anti-malware-protection-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure anti-malware policies in EOP",
        "url": "https://learn.microsoft.com/defender-office-365/anti-malware-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-205, ORCA-232)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.1.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-022",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-023",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}