Anti-malware policies are configured according to recommended settings

Overview

Anti-malware policies in Exchange Online Protection enforce the multi-engine malware scan, the Common Attachment Filter (which blocks executables and risky file types by extension regardless of engine verdict), zero-hour auto purge (ZAP) for messages reclassified as malicious after delivery, and the quarantine policy that determines whether a recipient can self-release a detected message.

Threat actors deliver malware as the second stage of the email kill chain immediately after a successful phish — typically as macro-enabled Office documents, ISO/IMG/VHD container files that bypass Mark-of-the-Web, HTML smuggling payloads, or password-protected archives that evade engine scanning. The Common Attachment Filter is the primary pre-delivery control that blocks these file types regardless of scan verdict, and ZAP is the only post-delivery control that retroactively removes messages whose verdict changes after delivery.

A default policy with the Common Attachment Filter disabled, ZAP disabled, or a quarantine policy that permits recipient self-release leaves the post-delivery branch of the kill chain unmitigated.

Remediation

• Configure anti-malware policies in EOP
• Recommended settings for EOP and Microsoft Defender for Office 365
• Set-MalwareFilterPolicy
• Anti-malware protection in EOP

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Anti-malware
Area	Email and collaboration protection
ATT&CK	T1566.001 Spearphishing Attachment, T1204.002 Malicious File
Licence	EXCHANGE_S_STANDARD
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.