(L1) Ensure notifications for internal users sending malware is Enabled

Contributed by Ben Miles with 2 co-contributorsAll contributors →

Part of CIS · Defender · Anti-malware · All checks

Run this check

Invoke-Maester -TestId CIS.M365.2.1.3

Overview

2.1.3 (L1) Ensure notifications for internal users sending malware is Enabled

Exchange Online Protection (EOP) is Microsoft’s cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes.

EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity.

The check evaluates the policy associated with the highest-priority enabled custom anti-malware rule when one exists; otherwise it evaluates the Default policy. The administrator notification address must be nonblank.

Rationale

This setting alerts administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated.

Impact

Notification of account with potential issues should not have an impact on the user

Remediation action

To enable notifications for internal users sending malware:

1. Navigate to Microsoft 365 Defender https://security.microsoft.com.
2. Click to expand E-mail & Collaboration select Policies & rules.
3. On the Policies & rules page select Threat policies.
4. Under Policies select Anti-malware.
5. Click on the Default (Default) policy, unless the check identifies a higher-priority enabled custom policy.
6. Click on Edit protection settings and change the settings for Notify an admin about undelivered messages from internal senders to On and enter the email address of the administrator who should be notified under Administrator email address.
7. Click Save.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following command:

Set-MalwareFilterPolicy -Identity '{Identity Name}' -EnableInternalSenderAdminNotifications $True -InternalSenderAdminAddress {[email protected]}

Note: If the check identifies a custom policy, use that policy’s identity in the PowerShell command and configure its notification address.

Related links

• Microsoft 365 Defender
• Anti-malware protection for cloud mailboxes
• Configure anti-malware policies for cloud mailboxes
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 88

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.1.3
Severity	Medium
Suite	CIS
Product	Defender
Related products	Exchange Online
Feature	Anti-malware
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1534 Internal Spearphishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.3
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:2.1.3, nist-800-53-r5:SI-4(5)
PowerShell test	Test-MtCisInternalMalwareNotification
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.2.1.3.ps1
• Documentation: tests/cis/Test.CIS.M365.2.1.3.md