Safe Links is enabled intra-organization
ORCA.179MediumDefenderSafe Links
Part of ORCA · Defender · Safe Links · All checks
Invoke-Maester -TestId ORCA.179Overview
Section titled “Overview”Phishing attacks are not limited from external users. Commonly, when one user is compromised, that user can be used in a process of lateral movement between different accounts in your organization. Configuring Safe Links so that internal messages are also re-written can assist with lateral movement using phishing. The built-in policy is ignored in this check, as it only provides the minimum level of protection.
Remediation action
Section titled “Remediation action”Enable Safe Links between internal users.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe links
- Recommended settings for EOP and Microsoft Defender for Office 365
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.179 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1534 Internal Spearphishing, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA179 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.179.ps1 - Documentation:
tests/orca/Test.ORCA.179.md