M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.12.2 recommends that safe lists not be enabled. The connection filter safe list is a dynamic, third-party-sourced list of 'known good' senders whose mail bypasses spam filtering and sender authentication. Because the list is externally curated, enabling it cedes a security bypass decision to a source the organization does not control.
Valor recomendado
Connection filter policy EnableSafeList set to False for all policies
Remediación
Edit the connection filter policy and ensure the safe list option is turned off (EnableSafeList = False) so externally sourced 'known good' senders do not bypass spam and authentication checks. Verify the setting on the default and any custom connection filter policies. A connection filter IP block list may still be used to block known malicious senders.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-7, SI-8
- CIS M365 Benchmark
- 2.1.13
- MITRE ATT&CK
- T1566.001