# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-MAIL-025
title: Detonate email attachments with Safe Attachments set to Block for all recipients
finding:
  title: Email attachments are not detonated, or detected ones are still delivered
  description: New malware that no signature knows yet reaches users inside attachments, because no Safe Attachments policy blocks it for every recipient.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [defender-for-office-365, safe-attachments, sandboxing, malware, attachments]

applicability:
  requires:
    - "Microsoft Defender for Office 365 Plan 1"

description: |
  Every recipient is covered by a Safe Attachments policy (the Standard or Strict preset, or a
  custom policy) with:

  - **Safe Attachments unknown malware response** set to **Block** (`Enable $true`, `Action Block`);
  - quarantine policy **AdminOnlyAccessPolicy** (`QuarantineTag`);
  - recipient conditions that cover every accepted domain, with no exceptions other than
    documented service mailboxes.

  No mail flow rule skips Safe Attachments processing (rules that set the
  `X-MS-Exchange-Organization-SkipSafeAttachmentProcessing` header).
rationale: |
  Safe Attachments opens attachments in a sandbox and watches their behavior, which catches new
  and targeted malware that signature scanning misses. With **Block**, detected messages are
  quarantined instead of being delivered; **Monitor** or **Off** only report. A single bypass rule
  or a missing domain in the conditions leaves a hole that attackers find.
impact: |
  Messages with attachments can be delayed while they are scanned (usually under a few minutes).
  Messages with detected attachments go to admin-only quarantine.

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Safe
       Attachments**. Check that the **Standard Preset Security Policy** (or **Strict**) or a custom
       policy is on and applies to all recipients, with **Safe Attachments unknown malware response**
       set to **Block** and **Quarantine policy** **AdminOnlyAccessPolicy**.
    3. In the Exchange admin center, **Mail flow** > **Rules**, look for rules that set the header
       `X-MS-Exchange-Organization-SkipSafeAttachmentProcessing`.
    4. In Exchange Online PowerShell (read-only):
       ```powershell
       Get-SafeAttachmentPolicy | Format-Table Name, Enable, Action, QuarantineTag, IsBuiltInProtection
       Get-SafeAttachmentRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
       Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeAttachmentProcessing*' } | Format-Table Name, State
       ```
    5. Fail if some recipients are only covered by a policy with `Enable $false` or `Action` other
       than `Block` (`Monitor`, `Allow`), or if a mail flow rule skips Safe Attachments.

remediation:
  manual: |
    1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019).
    2. For a custom policy, in **Safe Attachments** select **Create** (or edit), set the users and
       domains to all accepted domains, **Safe Attachments unknown malware response** to **Block**,
       **Quarantine policy** to **AdminOnlyAccessPolicy**, and save.
    3. PowerShell equivalent (Security Administrator):
       ```powershell
       Set-SafeAttachmentPolicy -Identity "<policy>" -Enable $true -Action Block -QuarantineTag AdminOnlyAccessPolicy
       ```
    4. Remove or rewrite the mail flow rules that skip Safe Attachments.
  rollback: |
    Set the custom policy back to its previous action, or turn it off; the Built-in protection
    preset still applies.

references:
  - title: Safe Attachments in Microsoft Defender for Office 365
    url: https://learn.microsoft.com/defender-office-365/safe-attachments-about
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set up Safe Attachments policies in Microsoft Defender for Office 365
    url: https://learn.microsoft.com/defender-office-365/safe-attachments-policies-configure
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-124, ORCA-227, ORCA-189)
    url: https://github.com/cammurray/orca
    publisher: Microsoft (community project)
    kind: tool
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "2.1.4"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SC-44
    relation: related
threats:
  - framework: mitre-attack
    id: T1566.001
related_controls:
  - id: CB-M365-MAIL-019
    type: related
  - id: CB-M365-MAIL-026
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24