Block an extended list of risky file types in anti-malware policies

Description

On top of the default list (CB-M365-MAIL-021), the common attachments filter of every anti-malware policy that applies to users also blocks these file types:

{{ extended_file_types }}

The list is chosen from the additional file types Microsoft offers in the Defender portal and covers scripts, shortcuts and shell files, Access and help files, disk images and less common archives, and macro-enabled Office formats. Policies of the Standard and Strict presets cannot be edited: the extended list requires a custom anti-malware policy with a higher priority, applied to the same recipients.

Rationale

Attackers move to whatever format is not blocked: JavaScript and HTML application files, shortcut files, OneNote files, ISO and VHD images, password-protected archives, macro-enabled documents. Blocking the ones the organization does not exchange by email removes many initial access paths without relying on detection.

Impact

Legitimate exchanges of these formats (archives with partners, macro-enabled spreadsheets, scripts between IT staff) are rejected. Review the list with the business and remove formats that are really needed, or route those exchanges through SharePoint or OneDrive.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-malware and open the policies that apply to users.
3. Check that the common attachments filter lists the default types and every type of the parameter.
4. In Exchange Online PowerShell (read-only):

   $required = @('7z','js','one','vhd','ps1')   # replace with the full parameter list
   foreach ($p in Get-MalwareFilterPolicy) {
     [pscustomobject]@{ Name = $p.Name; Missing = ($required | Where-Object { $_ -notin $p.FileTypes }) -join ',' }
   }
   

5. Fail if a policy that applies to users lacks one of the listed types.

Remediation

1. In the Defender portal, create a custom anti-malware policy (or edit the default one) that applies to all accepted domains, with a higher priority than the default policy.
2. In Protection settings, select Enable the common attachments filter > Select file types, add the types of the parameter, choose Reject the message with a non-delivery report (NDR) and save.
3. PowerShell equivalent (Security Administrator):

   $types = (Get-MalwareFilterPolicy -Identity Default).FileTypes + @('7z','js','one','vhd','ps1')  # full parameter list
   Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true -FileTypes ($types | Sort-Object -Unique)
   

Rollback

Set -FileTypes back to the previous list.

References

• Anti-malware protection for email in Microsoft 365 (common attachments filter) Microsoft, vendor-doc, accessed 2026-10-24
• Set-MalwareFilterPolicy Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-MAIL-021 Turn on the common attachments filter in every anti-malware policy

People and lifecycle