Safe Links is not bypassed
ORCA.189.2HighDefenderMail flow
Part of ORCA · Defender · Mail flow · All checks
Invoke-Maester -TestId ORCA.189.2Overview
Section titled “Overview”Microsoft Defender for Office 365 Safe Links can help protect against phishing attacks by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. The protection can be bypassed using mail flow rules which set the X-MS-Exchange-Organization-SkipSafeLinksProcessing header for email messages.
Remediation action
Section titled “Remediation action”Remove mail flow rules which bypass Safe Links.
Related Links
Section titled “Related Links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.189.2 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | MailFlowRule |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566.002 Spearphishing Link, T1204.001 Malicious Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA189_2 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.189.2.ps1 - Documentation:
tests/orca/Test.ORCA.189.2.md