At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe)
CISA.MS.EXO.9.5HighExchange OnlineAnti-malware
Part of CISA · Exchange Online · Anti-malware · All checks
Invoke-Maester -TestId CISA.MS.EXO.9.5Overview
Section titled “Overview”At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).
Rationale: Malicious attachments often take the form of click-to-run files. Blocking a list of common executable files helps mitigate the risk of adversarial exploitation.
Remediation action
Section titled “Remediation action”- Sign in to Microsoft 365 Defender.
- In the left-hand menu, go to Email & Collaboration > Policies & Rules.
- Select Threat Policies.
- From the Templated policies section, select Preset Security Policies.
- Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
- Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.
Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.
Related links
Section titled “Related links”- Defender admin center - Preset security policies
- CISA 9 Attachment File Type - MS.EXO.9.5v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.9.5 |
| Severity | High |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Anti-malware |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File, T1566.001 Spearphishing Attachment |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.9.5 |
| Criticality | SHOULD |
| Upstream requirement | Moved to MS.SECURITYSUITE.1.1v1 (was MS.EXO.9.5v1) |
| Supports controls | cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3 |
| PowerShell test | Test-MtCisaBlockExecutable |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cisa/exchange/Test.CISA.MS.EXO.9.5.ps1 - Documentation:
tests/cisa/exchange/Test.CISA.MS.EXO.9.5.md