M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.14.2 requires that spam and high confidence spam be moved to either the junk email folder or quarantine. Delivering spam to the inbox defeats the purpose of filtering and increases exposure to malicious content. The anti-spam policy actions must route detected spam away from the inbox while preserving user review of false positives.
Valor recomendado
SpamAction and HighConfidenceSpamAction set to MoveToJmf (junk) or Quarantine; never set to deliver to inbox
Remediación
Configure the anti-spam policy so the spam and high confidence spam actions move messages to the junk email folder or quarantine rather than delivering them to the inbox. Verify neither action is set to add a header and deliver. Confirm the policy applies to all recipients so spam routing is consistent.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566