CISA.MS.EXO.10.2 - Emails identified as containing malware SHALL be quarantined or dropped.

Overview

Emails identified as containing malware SHALL be quarantined or dropped.

Rationale: Email can be used as a mechanism for delivering malware. Preventing emails with known malware from reaching user mailboxes helps ensure users cannot interact with those emails.

Remediation action:

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
6. Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.

Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.

Related links

• Defender admin center - Preset security policies
• Defender admin center - Order and precedence of email protection
• CISA 10 Malware Scanning - MS.EXO.10.2v1
• CISA ScubaGear Rego Reference
• Microsoft Learn - Anatomy of a quarantine policy

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.10.2
Severity	High
Suite	CISA
Category	exchange
PowerShell test	Test-MtCisaMalwareAction
Tags	CISA, CISA.MS.EXO.10.2, MS.EXO, MS.EXO.10.2

Source

• Pester test: tests/cisa/exchange/Test-MtCisaMalwareAction.Tests.ps1
• PowerShell source: powershell/public/cisa/exchange/Test-MtCisaMalwareAction.ps1