Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and block

Overview

Email is the most common starting point for malware delivery, and the attachments that succeed are the ones that traditional anti-malware engines do not recognize: new variants, polymorphic loaders, password-protected archives, and container files such as ISO or IMG that bypass Windows reputation checks. When a recipient opens one of these attachments, the threat actor moves directly from delivery to execution, which is the step that establishes a foothold on the device, steals credentials, or starts lateral movement to other systems. Safe Attachments closes this gap by opening every unknown attachment in an isolated test environment before delivery and watching what it actually does — for example, whether it creates new processes, contacts external servers, or tries to install itself. If the file behaves like malware, Safe Attachments must block the message and quarantine it in a way that only an administrator can release, so the recipient never sees the attachment and cannot recover it on their own. A weaker setting — allowing the attachment, replacing it with a notice, or delivering the message body first and the attachment later — defeats the control, because the original file still reaches the recipient in some form and the kill chain continues at the execution step.

Remediation

• Safe Attachments in Microsoft Defender for Office 365
• Configure Safe Attachments policies
• Set-SafeAttachmentPolicy
• Preset security policies

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Safe Attachments
Area	Email and collaboration protection
ATT&CK	T1566.001 Spearphishing Attachment, T1204.002 Malicious File
Licence	ATP_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.