M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.9.1 requires that emails be filtered by attachment file type, comparable to the Common Attachment Filter. Many malware payloads arrive as click-to-run attachments. Filtering inbound mail by attachment type blocks dangerous file classes before they reach users, reducing the chance of accidental execution.
Recommended value
A malware/anti-malware policy with the common attachment type filter enabled (EnableFileFilter = True)
Remediation
Enable the common attachments filter on the anti-malware policy so inbound mail is filtered by attachment file type. Confirm the policy is applied to all recipients and not limited to a subset. Where a comparable third-party gateway provides this filtering, verify it is enabled and covers the same dangerous file classes.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SI-3
- CIS M365 Benchmark
- 2.1.11
- MITRE ATT&CK
- T1204.002