3.0 preview2.3.0 stable

Browse

Overview All checks1,254 MITRE ATT&CK149

Products

Active Directory275

Exchange Online61

Frameworks

NISTNIST SP 800-53 r575 CISCIS Microsoft 365144/144 CISCIS GitHub5 CISACISA SCuBA76/79 E8Essential Eight14/126 ISMASD ISM15

Packs

ZTAZero Trust Assessment364

Suites

Active Directory270 Maester255 CIS149 CISA SCuBA76 ORCA67 Entra ID SCA (EIDSCA)47 ASD Essential Eight14 Tags from 2.x

Exchange Online

61 checks19 High34 Medium8 Low

Run theseInvoke-Maester -Product exchange

CIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Mailbox auditingHigh CIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Mail flowHigh CIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Client accessHigh CISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Mail flowHigh CISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Email authenticationHigh CISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Client accessHigh CISA.MS.EXO.8.1A DLP solution SHALL be used.Data loss preventionHigh CISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Data loss preventionHigh CISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Anti-malwareHigh CISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Anti-malwareHigh CISA.MS.EXO.10.1Emails SHALL be scanned for malware.Anti-malwareHigh CISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Anti-malwareHigh CISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Anti-malwareHigh CISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Anti-phishingHigh CISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Mailbox auditingHigh CISA.MS.EXO.14.1A spam filter SHALL be enabled.Anti-spamHigh CISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Safe LinksHigh CISA.MS.EXO.16.1Alerts SHALL be enabled.Alert policiesHigh CISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Audit loggingHigh CIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Mailbox auditingMedium CIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Mailbox auditingMedium CIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Mail flowMedium CIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0OutlookMedium CIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0OutlookMedium CIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webOutlookMedium CIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Mail flowMedium CISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Email authenticationMedium CISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Email authenticationMedium CISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Email authenticationMedium CISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Email authenticationMedium CISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Calendar and contact sharingMedium CISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Calendar and contact sharingMedium CISA.MS.EXO.7.1External sender warnings SHALL be implemented.Mail flowMedium CISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Data loss preventionMedium CISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Data loss preventionMedium CISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Anti-malwareMedium CISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Anti-malwareMedium CISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Anti-malwareMedium CISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Anti-phishingMedium CISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Anti-phishingMedium CISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Anti-spamMedium CISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Anti-spamMedium CISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Anti-spamMedium CISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Anti-spamMedium CISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Anti-spamMedium CISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Safe LinksMedium CISA.MS.EXO.15.3User click tracking SHOULD be enabled.Safe LinksMedium CISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Alert policiesMedium CISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Audit loggingMedium MT.1041Ensure users installing Outlook add-ins is not allowedOutlookMedium MT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsMail flowMedium MT.1062Ensure Direct Send is set to be rejectedMail flowMedium ZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAMail flowMedium CIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0OutlookLow CIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Client accessLow CIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0OutlookLow MT.1039Ensure MailTips are enabled for end usersOutlookLow MT.1044Ensure modern authentication for Exchange Online is enabledClient accessLow MT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainMailboxesLow MT.1076MOERA SHOULD NOT be used for sent mailMailboxesLow MT.1083Ensure Delicensing Resiliency is enabledMailboxesLow