Domains are not being allow listed in an unsafe manner in Anti-Spam Policies
ORCA.118.1HighDefenderAnti-spam
Part of ORCA · Defender · Anti-spam · All checks
Invoke-Maester -TestId ORCA.118.1Overview
Section titled “Overview”Emails coming from allow listed domains bypass several layers of protection within Exchange Online Protection. If domains are allow listed, they are open to being spoofed from malicious actors.
Remediation action
Section titled “Remediation action”Remove allow listing on domains.
Related Links
Section titled “Related Links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.118.1 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA118_1 |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.118.1.ps1 - Documentation:
tests/orca/Test.ORCA.118.1.md