(L2) Ensure comprehensive attachment filtering is applied

CIS.M365.2.1.11MediumDefenderAnti-malware

Contributed by Ben Miles with -MynsterAll contributors →

Part of CIS · Defender · Anti-malware · All checks

Invoke-Maester -TestId CIS.M365.2.1.11

Overview

2.1.11 (L2) Ensure comprehensive attachment filtering is applied

The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails. The policy provided by Microsoft covers 53 extensions, and an additional custom list of extensions can be defined. The list of 186 extensions provided in this recommendation is comprehensive but not exhaustive.

This check evaluates each policy with more than 120 file types independently. At least one policy must have file filtering enabled, an associated enabled rule, and 90% or more of the benchmark extension list. Recipient scope is not evaluated, matching the CIS audit procedure.

Rationale

Blocking known malicious file types can help prevent malware-infested files from infecting a host or performing other malicious attacks such as phishing and data extraction. Defining a comprehensive list of attachments can help protect against additional unknown and known threats. Many legacy file formats, binary files and compressed files have been used as delivery mechanisms for malicious software. Organizations can protect themselves from Business E-mail Compromise (BEC) by allow-listing only the file types relevant to their line of business and blocking all others.

Impact

For file types that are business necessary users will need to use other organizationally approved methods to transfer blocked extension types between business partners.

Remediation action

To implement a new policy containing a comprehensive list of extensions:

Connect to Exchange Online using Connect-ExchangeOnline.
Run the following script after editing InternalSenderAdminAddress:

# Create an attachment policy and associated rule. The rule is
# intentionally disabled allowing the org to enable it when ready
$Policy = @{
    Name                                   = "CIS L2 Attachment Policy"
    EnableFileFilter                       = $true
    ZapEnabled                             = $true
    EnableInternalSenderAdminNotifications = $true
    InternalSenderAdminAddress             = '[email protected]' # Change this.
}
$L2Extensions = @(
    "7z", "a3x", "ace", "ade", "adp", "ani", "apk", "app", "appinstaller",
    "applescript", "application", "appref-ms", "appx", "appxbundle", "arj",
    "asd", "asx", "bas", "bat", "bgi", "bz2", "cab", "chm", "cmd", "com",
    "cpl", "crt", "cs", "csh", "daa", "dbf", "dcr", "deb",
    "desktopthemepackfile", "dex", "diagcab", "dif", "dir", "dll", "dmg",
    "doc", "docm", "dot", "dotm", "elf", "eml", "exe", "fxp", "gadget", "gz",
    "hlp", "hta", "htc", "htm", "html", "hwpx", "ics", "img",
    "inf", "ins", "iqy", "iso", "isp", "jar", "jnlp", "js", "jse", "kext",
    "ksh", "lha", "lib", "library", "library-ms", "lnk", "lzh", "macho", "mam", "mda",
    "mdb", "mde", "mdt", "mdw", "mdz", "mht", "mhtml", "mof", "msc", "msi",
    "msix", "msp", "msrcincident", "mst", "ocx", "odt", "ops", "oxps", "pcd",
    "pif", "plg", "pot", "potm", "ppa", "ppam", "ppkg", "pps", "ppsm", "ppt",
    "pptm", "prf", "prg", "ps1", "ps11", "ps11xml", "ps1xml", "ps2",
    "ps2xml", "psc1", "psc2", "pub", "py", "pyc", "pyo", "pyw", "pyz",
    "pyzw", "rar", "reg", "rev", "rtf", "scf", "scpt", "scr", "sct",
    "searchConnector-ms", "service", "settingcontent-ms", "sh", "shb", "shs",
    "shtm", "shtml", "sldm", "slk", "so", "spl", "stm", "svg", "swf", "sys",
    "tar", "theme", "themepack", "timer", "uif", "url", "uue", "vb", "vbe",
    "vbs", "vhd", "vhdx", "vxd", "wbk", "website", "wim", "wiz", "ws", "wsc",
    "wsf", "wsh", "xla", "xlam", "xlc", "xll", "xlm", "xls", "xlsb", "xlsm",
    "xlt", "xltm", "xlw", "xnk", "xps", "xsl", "xz", "z"
)
# Create the policy
New-MalwareFilterPolicy @Policy -FileTypes $L2Extensions
# Create the rule for all accepted domains
$Rule = @{
    Name                = $Policy.Name
    Enabled             = $false
    MalwareFilterPolicy = $Policy.Name
    RecipientDomainIs   = (Get-AcceptedDomain).Name
    Priority            = 0
}
New-MalwareFilterRule @Rule

When prepared enable the rule either through the UI or PowerShell.

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.1.11
Severity	Medium
Suite	CIS
Product	Defender
Related products	Exchange Online
Feature	Anti-malware
Area	Email and collaboration protection
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1566.001 Spearphishing Attachment, T1204.002 Malicious File
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.11
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:2.1.11, nist-800-53-r5:SI-3
PowerShell test	Test-MtCisAttachmentFilterComprehensive
Services	ExchangeOnline

Source

Test: tests/cis/Test.CIS.M365.2.1.11.ps1
Documentation: tests/cis/Test.CIS.M365.2.1.11.md