# Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter. Source: https://maester.dev/docs/tests/CISA.MS.EXO.9.4

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Part of CISA · Exchange Online · Anti-malware · All checks

```powershell title="Run this check" Invoke-Maester -TestId CISA.MS.EXO.9.4 ``` ## Overview Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter. Rationale: Malicious attachments often take the form of click-to-run files. Sharing high risk file types, when necessary, is better left to a means other than email; the dangers of allowing them to be sent over email outweigh any potential benefits. Filtering email attachments based on file types can prevent spread of malware distributed via click-to-run email attachments. > Note: This test will always result in a skip result. #### Remediation action 1. Sign in to **Microsoft 365 Defender**. 2. In the left-hand menu, go to **Email & Collaboration** > **Policies & Rules**. 3. Select **Threat Policies**. 4. From the **Templated policies** section, select **Preset Security Policies**. 5. Under **Standard protection**, slide the toggle switch to the right so the text next to the toggle reads **Standard protection is on**. 6. Under **Strict protection**, slide the toggle switch to the right so the text next to the toggle reads **Strict protection is on**. Note: If the toggle slider in step 5 is grayed out, click on **Manage protection settings** instead and configure the policy settings according to [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn](https://learn.microsoft.com/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). #### Related links * [Defender admin center - Preset security policies](https://security.microsoft.com/presetSecurityPolicies) * [CISA 9 Attachment File Type - MS.EXO.9.4v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo94v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/EXOConfig.rego#L532) ## Details

Every attribute of this check

| Field | Value | | --- | --- | | Test ID | CISA.MS.EXO.9.4 | | Severity | Medium | | Suite | CISA | | Product | Exchange Online | | Related products | Defender | | Feature | Anti-malware | | Area | Email and collaboration protection | | Resource type | Tenant | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1204.002 Malicious File, T1566.001 Spearphishing Attachment | | Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.9.4 | | Criticality | SHOULD | | Upstream requirement | Removed (was MS.EXO.9.4v1) | | Supports controls | cisa-scuba:MS.EXO.9.4 | | PowerShell test | [Test-MtCisaEmailFilterAlternative](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.9.4.ps1) | | Services | ExchangeOnline, Graph, SecurityCompliance |

## Source - Test: [`tests/cisa/exchange/Test.CISA.MS.EXO.9.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.9.4.ps1) - Documentation: [`tests/cisa/exchange/Test.CISA.MS.EXO.9.4.md`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.9.4.md)