M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.11.1 recommends that impersonation protection checks be used. Impersonation protection compares sender addresses against known users and domains to flag look-alike addresses (for example, exmple.com versus example.com). Without it, users must manually distinguish near-identical sender addresses, which is unreliable and increases phishing success.
Valor recomendado
Anti-phish policy with user and/or domain impersonation protection enabled and applied to high-value targets
Remediación
Enable user and domain impersonation protection in an anti-phish policy and apply it to high-value targets such as executives, finance, and IT, plus organizational and key partner domains. Set the action for impersonated messages to quarantine. Note that impersonation protection requires a Defender for Office 365 plan; if unavailable, evaluate a comparable third-party capability.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1656, T1566