M365EXO-023: External sender warning implemented (MS.EXO.7.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.7.1 requires that external sender warnings be implemented. Marking mail that originates outside the organization helps users recognize impersonation and social engineering attempts. This can be delivered via the native external sender tag (Set-ExternalInOutlook) or a mail flow rule that prepends an indicator such as [External] to the subject of inbound external mail.
Valor recomendado
Native external sender identification enabled (Get-ExternalInOutlook Enabled = True) or a mail flow rule that prepends an external marker to inbound external mail
Remediación
Enable the native external sender identification feature so Outlook displays an External tag on mail from outside the organization. Alternatively, or in addition, create an enabled mail flow rule that prepends a marker such as [External] to the subject of mail received from outside the organization. Communicate the change to users so they understand what the indicator means.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.EXO.7.1v1
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566