CISA.MS.EXO.9.5: At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).

ID	CISA.MS.EXO.9.5
Severity	High
Suite	CISA SCuBA baselines
Product	Exchange Online
Related products	Defender
Feature	Anti-malware
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.9.5 (SHOULD)
Framework controls	cisa-scuba:MS.EXO.9.5 nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK	T1204.002, T1566.001
Reads from	Exchange Online, Security & Compliance PowerShell

What this checks and how to fix it

At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).

Rationale: Malicious attachments often take the form of click-to-run files. Blocking a list of common executable files helps mitigate the risk of adversarial exploitation.

Remediation action

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
6. Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.

Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.

Related links

• Defender admin center - Preset security policies
• CISA 9 Attachment File Type - MS.EXO.9.5v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.