Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in email

Overview

Email content can be judged clean at the moment of delivery and later be reclassified as malware, phishing, or spam once new threat intelligence arrives. Without zero-hour auto purge, that reclassified message stays in the user’s inbox, the user opens the attachment or follows the link in the minutes or hours after delivery, and the threat actor obtains the credential or executes the payload — the protection arrived but never reached the user. Zero-hour auto purge, a capability of Exchange Online Protection available to all cloud mailboxes, retroactively moves the message to quarantine or the Junk Email folder after the verdict changes, closing the gap between delivery and detection. This check confirms zero-hour auto purge is enabled for malware, phishing, and spam in email, so a delayed verdict still results in containment.

Remediation

• Zero-hour auto purge (ZAP) in Exchange Online
• Set-MalwareFilterPolicy
• Set-HostedContentFilterPolicy

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Zero-hour auto purge
Area	Email and collaboration protection
ATT&CK	T1566 Phishing
Licence	EXCHANGE_S_STANDARD
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.