Anti-malware protection for email In Microsoft 365 - Microsoft Defender for Office 365 (original) (raw)

In all organizations with cloud mailboxes, anti-malware protection for email is on by default. Some of the major categories of malware are:

Anti-malware protection for email in Microsoft 365 is multi-layered and designed to catch all known malware that travels into or out of your organization. The following options help provide anti-malware protection:

Microsoft 365 quarantines messages when malware is found in any attachment*. Whether the recipients can view or otherwise interact with the quarantined messages is controlled by quarantine policies. By default, messages that were quarantined due to malware can only be viewed and released by admins. Users can't release their own quarantined malware messages, regardless of any available settings that admins configure. For more information, see the following articles:

* Malware filtering is skipped on SecOps mailboxes that are identified in the advanced delivery policy. For more information, see Configure the advanced delivery policy for non-Microsoft phishing simulations and email delivery to SecOps mailboxes.

Anti-malware policies also contain a common attachments filter. Messages that contain the specified file types are automatically rejected (default) or quarantined based on the policy setting. For more information, see the Common attachments filter in anti-malware policies section later in this article.

For more information about anti-malware protection, see the Frequently asked questions: Anti-malware protection.

To configure the default anti-malware policy, and to create, modify, and remove custom anti-malware policies, see Configure anti-malware policies. In the Standard and Strict preset security policies, the anti-malware policy settings are already configured and unmodifiable as described in Anti-malware policy settings.

Anti-malware policies

Anti-malware policies control the configurable settings and notification options for malware detections. The important settings in anti-malware policies are described in the following subsections.

Recipient filters in anti-malware policies

Recipient filters use conditions and exceptions to identify the internal recipients that the policy applies to. At least one condition is required in custom policies. Conditions and exceptions aren't available in the default policy (the default policy applies to all recipients). You can use the following recipient filters for conditions and exceptions:

You can use a condition or exception only once, but the condition or exception can contain multiple values:

Common attachments filter in anti-malware policies

Some types of files aren't suited to email (for example, executable files). Rather than scanning these files for malware, why not block them all? That's where the common attachments filter comes in. When the common attachments filter detects a file type that you specified, you can Reject the message with a non-delivery report (NDR) (the default value) or Quarantine the message. Because the block is from an admin-defined policy, these messages don't get a malware verdict.

A list of default file types is used in the default anti-malware policy, in custom anti-malware policies that you create, and in the anti-malware policies in the Standard and Strict preset security policies.

In the Microsoft Defender portal, you can select from a list of additional file types or add your own values when you create or modify anti-malware policies in the Microsoft Defender portal.

True type matching in the common attachments filter

The common attachments filter uses best effort true type matching to detect the file type, regardless of the filename extension. True type matching uses file characteristics to determine the real file type (for example, leading and trailing bytes in the file). For example, if an exe file is renamed with a txt filename extension, the common attachments filter detects the file as an exe file.

True type matching in the common attachments filter supports the following file types:

7zip, ace, adoc, ani, arc, arj, asf, asice, avi, bmp, bz, bz2, cab, cda, chm, deb, dex, dll, dmg, doc, docm, docx, dot, dotm, dotx, dwg, eml, eps, epub, excelml, exe, fluid, gif, gzip, heic, heif, html, hyper, icon, ics, infopathml, jar, javabytecode, jnlp, jpeg, json, lib, lnk, lzh, lzma, macho, mhtml, mp3, mp4, mpeg, mpp, msaccess, mscompress, msg, msp, musx, nws, obd, obj, obt, odbcexcel, odc, odf, odg, odi, odm, odp, ods, odt, one, otc, otf, otg, oth, oti, otp, ots, ott, pal, pcx, pdf, pfb, pfile, pif, png, pointpub, pot, potm, potx, powerpointml, ppam, pps, ppsm, ppsx, ppt, pptm, pptx, ps, pub, qcp, quicktime, rar, rar4, riff, rmi, rpm, rpmsg, rtf, smime, swf, tar, tiff, tlb, tnef, ttf, txt, vcf, vcs, vdw, vdx, vsd, vsdm, vsdx, vss, vssm, vssx, vst, vstm, vstx, vsx, vtt, vtx, wav, webp, whiteboard, wmf, woff, woff2, word2, wordml, xar, xlam, xlb, xlc, xls, xlsb, xlsm, xlsx, xlt, xltm, xltx, xml, xps, xz, z, zip, zoo

If true type matching fails or isn't supported for the file type, then simple extension matching is used.

Zero-hour auto purge (ZAP) in anti-malware policies

ZAP for malware quarantines messages that are found to contain malware after they've been delivered to Exchange Online mailboxes. By default, ZAP for malware is turned on, and we recommend that you leave it on. For more information, see Zero-hour auto purge (ZAP) for malware.

Quarantine policies in anti-malware policies

Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. By default, recipients don't receive notifications for messages that were quarantined as malware, and users can't release their own quarantined malware messages, regardless of any available settings that admins configure. For more information, see Anatomy of a quarantine policy.

Admin notifications in anti-malware policies

You can specify an additional recipient (an admin) to receive notifications for malware detected in messages from internal or external senders. You can customize the From address, subject, and message text for internal and external notifications.

These settings aren't configured in the default anti-malware policy by default, or in the Standard or Strict preset security policies.

Tip

Admin notifications are sent only for attachments that are classified as malware.

The quarantine policy that's assigned to the anti-malware policy determines whether recipients receive email notifications for messages that were quarantined as malware.

Priority of anti-malware policies

If preset security policies are turned on, the Standard and Strict preset security policies are applied before any custom anti-malware policies or the default policy. If you create multiple custom anti-malware policies, you can specify the order of policy application. Policy processing stops for eligible recipients after the application of the first eligible policy (the highest priority policy for that recipient).

For more information about the order of precedence and how multiple policies are evaluated, see Order and precedence of email protection and Order of precedence for preset security policies and other policies.

Default anti-malware policy

Every organization has a built-in anti-malware policy named Default that has the following properties: