# Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and block
Email is the most common starting point for malware delivery, and the attachments that succeed are the ones that traditional anti-malware engines do not…
Source: https://maester.dev/docs/tests/ZTA.41031
## Overview
Email is the most common starting point for malware delivery, and the attachments that succeed are the ones that traditional anti-malware engines do not recognize: new variants, polymorphic loaders, password-protected archives, and container files such as ISO or IMG that bypass Windows reputation checks. When a recipient opens one of these attachments, the threat actor moves directly from delivery to execution, which is the step that establishes a foothold on the device, steals credentials, or starts lateral movement to other systems. Safe Attachments closes this gap by opening every unknown attachment in an isolated test environment before delivery and watching what it actually does — for example, whether it creates new processes, contacts external servers, or tries to install itself. If the file behaves like malware, Safe Attachments must block the message and quarantine it in a way that only an administrator can release, so the recipient never sees the attachment and cannot recover it on their own. A weaker setting — allowing the attachment, replacing it with a notice, or delivering the message body first and the attachment later — defeats the control, because the original file still reaches the recipient in some form and the kill chain continues at the execution step.
## Remediation
- [Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about)
- [Configure Safe Attachments policies](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-policies-configure)
- [Set-SafeAttachmentPolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/set-safeattachmentpolicy)
- [Preset security policies](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Email and collaboration security |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Safe Attachments |
| Area | Email and collaboration protection |
| ATT&CK | [T1566.001](/docs/tests?mitre=T1566.001) Spearphishing Attachment, [T1204.002](/docs/tests?mitre=T1204.002) Malicious File |
| Licence | ATP_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.