CIS.M365.2.1.4: Ensure Safe Attachments policy is enabled (Only Checks Default Policy)

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.2.1.4
Severity	High
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Defender
Related products	Exchange Online
Feature	Safe Attachments
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 2.1.4 (L2, E5 Level 2)
Framework controls	cis-m365:2.1.4 nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK	T1566.001, T1204.002
Reads from	Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed	ATP_ENTERPRISE

What this checks and how to fix it

2.1.4 (L2) Ensure Safe Attachments policy is enabled

The Safe Attachments policy helps protect users from malware in email attachments by scanning attachments for viruses, malware, and other malicious content. When an email attachment is received by a user, Safe Attachments will scan the attachment in a secure environment and provide a verdict on whether the attachment is safe or not.

Rationale

Enabling Safe Attachments policy helps protect against malware threats in email attachments by analyzing suspicious attachments in a secure, cloud-based environment before they are delivered to the user’s inbox. This provides an additional layer of security and can prevent new or unseen types of malware from infiltrating the organization’s network.

Impact

Delivery of email with attachments may be delayed while scanning is occurring

Remediation action

To enable the Safe Attachments policy:

1. Navigate to Microsoft 365 Defender.
2. Click to expand E-mail & Collaboration select Policies & rules.
3. On the Policies & rules page select Threat policies.
4. Under Policies select Safe Attachments.
5. Click + Create.
6. Create a Policy Name and Description, and then click Next.
7. Select all valid domains and click Next.
8. Select Block.
9. Quarantine policy is AdminOnlyAccessPolicy.
10. Leave Enable redirect unchecked.
11. Click Next and finally Submit.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. To change an existing policy modify the example below and run the following PowerShell command:

Set-SafeAttachmentPolicy -Identity 'Example policy' -Action 'Block' -QuarantineTag 'AdminOnlyAccessPolicy' -Enable $true

3. Or, edit and run the below example to create a new safe attachments policy.

New-SafeAttachmentPolicy -Name "CIS 2.1.4" -Enable $true -Action 'Block' -QuarantineTag 'AdminOnlyAccessPolicy'

New-SafeAttachmentRule -Name "CIS 2.1.4 Rule" -SafeAttachmentPolicy "CIS 2.1.4" -RecipientDomainIs 'exampledomain[.]com'

Note: Policy targets such as users and domains should include domains, or groups that provide coverage for a majority of users in the organization. Different inclusion and exclusion use cases are not covered in the benchmark.

Related links

• Microsoft 365 Defender
• Safe Attachments in Microsoft Defender for Office 365
• Set up Safe Attachments policies in Microsoft Defender for Office 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 92

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: weyCC81, thomas-s-schmidt. Open-source licences.