You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/address-compromised-users-quickly.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ ms.date: 06/09/2023
17
17
description: Learn how to speed up the process of detecting and addressing compromised user accounts with automated investigation and response capabilities in Microsoft Defender for Office 365 Plan 2.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Default email protections in Microsoft 365</a>
21
21
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
description: Admins can learn about anti-malware protection and anti-malware policies that protect against viruses, spyware, and ransomware in Exchange Online Protection (EOP).
17
+
description: Admins can learn about anti-malware email protection and anti-malware policies that protect against viruses, spyware, and ransomware in Microsoft 365.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Default email protections in Microsoft 365</a>
23
23
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against malware by EOP. Some of the major categories of malware are:
31
+
In Microsoft 365 organizations with cloud mailboxes, anti-malware protection for email is on by default. Some of the major categories of malware are:
32
32
33
33
-**Viruses** that infect other programs and data, and spread through your computer or network looking for programs to infect.
34
34
-**Spyware** that gathers your personal information, such as sign-in information and personal data, and sends it back to its author.
35
35
-**Ransomware** that encrypts your data and demands payment to decrypt it. Anti-malware software doesn't help you decrypt encrypted files, but it can detect the malware payload that's associated with the ransomware.
36
36
37
-
EOP offers multi-layered malware protection that's designed to catch all known malware in Windows, Linux, and Mac that travels into or out of your organization. The following options help provide anti-malware protection:
37
+
Anti-malware protection for email in Microsoft 365 is multi-layered and designed to catch all known malware that travels into or out of your organization. The following options help provide anti-malware protection:
38
38
39
-
-**Layered defenses against malware**: Anti-malware scans help protect against both known and unknown threats. Microsoft's anti-malware includes powerful heuristic detection that provides protection even during the early stages of a malware outbreak.
39
+
-**Layered defenses against malware**: Anti-malware scans of email help protect against both known and unknown threats. Microsoft's anti-malware includes powerful heuristic detection that provides protection even during the early stages of a malware outbreak.
40
40
-**Real-time threat response**: During some outbreaks, the anti-malware team might have enough information about a virus or other form of malware to write sophisticated policy rules that detect the threat, even before a definition is available. These rules are published to the global network every 2 hours to provide your organization with an extra layer of protection against attacks.
41
41
-**Fast anti-malware definition deployment**: The anti-malware team can receive and integrate malware definitions and patches before they're publicly released.
42
42
43
-
In EOP, messages that are found to contain malware in _any_attachments are quarantined<sup>\*</sup>. Whether the recipients can view or otherwise interact with the quarantined messages is controlled by _quarantine policies_. By default, messages that were quarantined due to malware can only be viewed and released by admins. Users can't release their own quarantined malware messages, regardless of any available settings that admins configure. For more information, see the following articles:
43
+
Microsoft 365 quarantines messages when malware is found in _any_attachment<sup>\*</sup>. Whether the recipients can view or otherwise interact with the quarantined messages is controlled by _quarantine policies_. By default, messages that were quarantined due to malware can only be viewed and released by admins. Users can't release their own quarantined malware messages, regardless of any available settings that admins configure. For more information, see the following articles:
44
44
45
45
<sup>\*</sup> Malware filtering is skipped on SecOps mailboxes that are identified in the advanced delivery policy. For more information, see [Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes](advanced-delivery-policy-configure.md).
46
46
@@ -51,7 +51,7 @@ Anti-malware policies also contain a _common attachments filter_. Messages that
51
51
52
52
For more information about anti-malware protection, see the [Frequently asked questions: Anti-malware protection for email in Microsoft 365](anti-malware-protection-faq.yml).
53
53
54
-
To configure the default anti-malware policy, and to create, modify, and remove custom anti-malware policies, see [Configure anti-malware policies](anti-malware-policies-configure.md). In the Standard and Strict [preset security policies](preset-security-policies.md), the anti-malware policy settings are already configured and unmodifiable as described in [EOP anti-malware policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-malware-policy-settings).
54
+
To configure the default anti-malware policy, and to create, modify, and remove custom anti-malware policies, see [Configure anti-malware policies](anti-malware-policies-configure.md). In the Standard and Strict [preset security policies](preset-security-policies.md), the anti-malware policy settings are already configured and unmodifiable as described in [Anti-malware policy settings](recommended-settings-for-eop-and-office365.md#anti-malware-policy-settings).
55
55
56
56
> [!TIP]
57
57
> If you disagree with the malware verdict, you can report the message attachment to Microsoft as a false positive (good attachment marked as bad) or a false negative (bad attachment allowed). For more information, see [How do I report a suspicious email or file to Microsoft?](submissions-report-messages-files-to-microsoft.md).
This article provides frequently asked questions and answers about anti-malware protection for Microsoft 365 organizations with mailboxes in Exchange Online, or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes.
32
+
This article provides frequently asked questions and answers about anti-malware protection for email in Microsoft 365 organizations with cloud mailboxes.
33
33
34
34
For questions and answers about the quarantine, see [Quarantine FAQ](quarantine-faq.yml).
35
35
@@ -43,7 +43,7 @@ sections:
43
43
- question: |
44
44
What are best practice recommendations for configuring and using the service to combat malware?
45
45
answer: |
46
-
See [EOP anti-malware policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-malware-policy-settings).
46
+
See [Anti-malware policy settings](recommended-settings-for-eop-and-office365.md#anti-malware-policy-settings).
47
47
48
48
- question: |
49
49
How often are the malware definitions updated?
@@ -68,9 +68,7 @@ sections:
68
68
- question: |
69
69
Does the service scan internal messages for malware?
70
70
answer: |
71
-
For organizations with Exchange Online mailboxes, the service scans for malware in all inbound and outbound messages, including messages sent between internal recipients.
72
-
73
-
A standalone EOP subscription scans messages as they enter or leave the on-premises email organization. Messages sent between internal on-premises recipients aren't scanned for malware. However, you can use the built-in anti-malware scanning features of Exchange Server. For more information, see [Anti-malware protection in Exchange Server](/Exchange/antispam-and-antimalware/antimalware-protection/antimalware-protection).
71
+
For Microsoft 365 organizations with cloud mailboxes, the service scans for malware in all inbound and outbound messages, including messages sent between internal recipients.
74
72
75
73
- question: |
76
74
Is heuristic scanning enabled?
@@ -104,11 +102,9 @@ sections:
104
102
- question: |
105
103
How can I configure the service to block specific executable files (such as \*.exe) that I fear may contain malware?
106
104
answer: |
107
-
You can enable and configure the *common attachments filter* (also known as *common attachment blocking*) as described in [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies).
108
-
109
-
You can also create an Exchange mail flow rule (also known as transport rule) that blocks any email attachment that has executable content.
105
+
You can configure the *common attachments filter* (also known as *common attachment blocking*) as described in [Common attachments filter in anti-malware policies](anti-malware-protection-about.md#common-attachments-filter-in-anti-malware-policies).
110
106
111
-
Follow the steps in [How to reduce malware threats through file attachment blocking in Exchange Online Protection](https://support.microsoft.com/help/2959596) to block the file types listed in [Supported file types for mail flow rule content inspection in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments#supported-file-types-for-mail-flow-rule-content-inspection).
107
+
You can also create an Exchange mail flow rule (also known as transport rule) that blocks any email attachment that has executable content. For instructions, see [Use mail flow rules to block messages with executable attachments in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-block-executable-attachments).
112
108
113
109
For increased protection, we also recommend using the **Any attachment file extension includes these words** condition in mail flow rules to block some or all of the following extensions: `ade, adp, ani, bas, bat, chm, cmd, com, cpl, crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb, mde, mdz, msc, msi, msp, mst, pcd, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh`.
114
110
@@ -150,9 +146,9 @@ sections:
150
146
Yes, the message trace tool enables you to follow email messages as they pass through the service. For more information about how to use the message trace tool to find out why a message was detected to contain malware, see [Message trace in the modern Exchange admin center](/exchange/monitoring/trace-an-email-message/message-trace-modern-eac).
151
147
152
148
- question: |
153
-
Can I use a third-party anti-spam and anti-malware provider with Exchange Online?
149
+
Can I use a non-Microsoft anti-spam and anti-malware provider with Exchange Online?
154
150
answer: |
155
-
Yes. In most cases, we recommend that you point your MX records to (that is, deliver email directly to) EOP. If you need to route your email somewhere else first, you need to enable [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) so EOP can use the true message source in filtering decisions.
151
+
Yes. Generally, we recommend that you point your MX records to (that is, deliver email directly to) Microsoft 365. If you need to route your email somewhere else first, you need to enable [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) so Microsoft 365 can use the true message source in filtering decisions.
156
152
157
153
- question: |
158
154
Are spam and malware messages being investigated as to who sent them, or being transferred to law enforcement entities?
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Default email protections in Microsoft 365</a>
25
25
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Default email protections in Microsoft 365</a>
24
24
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
Phishing attacks are a constant threat to any email organization. In addition to using [spoofed (forged) sender email addresses](anti-phishing-protection-spoofing-about.md), attackers often use values in the From address that violate internet standards. To help prevent this type of phishing, Exchange Online Protection (EOP) and Outlook.com require inbound messages to include an RFC-compliant From address as described in this article.
32
+
Phishing attacks are a constant threat to any email organization. In addition to using [spoofed (forged) sender email addresses](anti-phishing-protection-spoofing-about.md), attackers often use values in the From address that violate internet standards. To help prevent this type of phishing, Microsoft 365 requiref inbound messages to include an RFC-compliant From address as described in this article.
33
33
34
34
- If you regularly receive email from organizations that have malformed From addresses as described in this article, encourage these organizations to update their email servers to comply with modern security standards.
0 commit comments