> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/anti-malware.md). # Anti-malware Anti-malware is the `MalwareFilterPolicy` object in Exchange Online — signature-based malware scanning of email, plus a file-type filter that blocks entire categories of executable and script attachments outright, regardless of whether they contain a detected virus. It's the one Defender policy type Augmentt manages that doesn't require a Defender for Office 365 add-on. {% hint style="info" %} Anti-malware is part of standard **Exchange Online Protection** and needs no additional Defender license — see the main [Defender](/modules/secure/defender.md) page's licensing note. See that page too for how templates, baselines, and deployment work generally. {% endhint %} ## What you can configure * **Enable the common attachment types filter** (`EnableFileFilter`) — block a defined list of file extensions outright at the mail gateway, independent of malware scanning results. * **Customize the file types** (`FileTypes`) — the actual extension list the filter blocks (see Augmentt's two templates below for two very different list lengths). * **When these file types are found, action** (`FileTypeAction`) — what happens to a message whose attachment matches the blocked-extension list: **Reject** (bounce it back to the sender), **Quarantine**, or (in earlier product versions) **Delete**. * **Quarantine policy** (`QuarantineTag`) — which quarantine policy governs a message quarantined by this filter (e.g. `AdminOnlyAccessPolicy`). * **Enable zero-hour auto purge (ZAP) for malware** (`ZapEnabled`) — retroactively remove already-delivered mail from inboxes once it's later identified as malware. * **Notify internal senders when their message can't be delivered because of malware** (`EnableInternalSenderAdminNotifications` / `InternalSenderAdminAddress`) and the same for **external senders** (`EnableExternalSenderAdminNotifications` / `ExternalSenderAdminAddress`). * **Customize notifications** (`CustomNotifications`) — override Microsoft's default notification emails with your own **from name / from address** (`CustomFromName` / `CustomFromAddress`) and separate **subject / body** text for internal (`CustomInternalSubject` / `CustomInternalBody`) vs external (`CustomExternalSubject` / `CustomExternalBody`) senders. ## Augmentt's default templates Augmentt ships **two** out-of-the-box anti-malware templates, aimed at two different compliance bars: ### Anti-malware - Secure Score recommendations | Setting | Value | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enable common attachment types filter | On | | Blocked file extensions | 53 extensions (Microsoft's built-in default list — includes ace, apk, app, bat, cmd, com, dll, docm, exe, hta, iso, jar, jnlp, lnk, msi, msp, pif, reg, scr, sct, vbs, vbe, wsf, wsh, xll, and similar executable/script types) | | Action on matched file types | Reject | | Zero-hour auto purge | On | | Quarantine policy | AdminOnlyAccessPolicy | | Internal/external sender admin notifications | Off / Off | | Custom notifications | Off (Microsoft default text) | ### CIS M365 V6 L2 - Comprehensive Attachment Filtering 2.1.11 A separate, stricter template purpose-built to satisfy **CIS Microsoft 365 Foundations Benchmark v6, control 2.1.11**, which calls for a materially larger blocked-extension list than Microsoft's own 53-extension default (Microsoft's list is described in the CIS benchmark itself as covering roughly 53 extensions against a "comprehensive but not exhaustive" reference list of around 184). This template sets: | Setting | Value | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Enable common attachment types filter | On | | Blocked file extensions | The full CIS v6 §2.1.11 reference extension list (`CIS_M365_V6_2_1_11_REFERENCE_EXTENSIONS` in the codebase) | | All other fields | Not set by this template (only `EnableFileFilter` and `FileTypes` are configured — deploy alongside or on top of the Secure Score template above for the rest of the settings) | **Resolves posture check(s):** * **MDOATPPROTECTION** — Secure-Score-sourced check for overall anti-malware protection across the mail flow. Mapped to CMMC Level 1/2 (SI.L1-b.1.xiii, SI.L2-3.14.2/3.14.4 — Mail Anti-Malware), and CIS Controls v8 §10.1 ("Deploy and Maintain Anti-Malware Software"). * **MDOZAPMALWARE** — checks that zero-hour auto purge for malware is enabled. Mapped to CMMC SI.L1-b.1.xiv / SI.L2-3.14.4 (Update Malicious Code Protection). * **MDOCOMMONATTACHMENTSFILTER** and **CIS\_M365 §2.1.2 — "Ensure the Common Attachment Types Filter is enabled"** (CIS v6/v7, Level 1) — satisfied by either default template, since both turn `EnableFileFilter` on. Mapped to CMMC Level 2 (CM.L2-3.4.7 & SC.L2-3.13.13 — Block Risky Attachments), HIPAA §164.308(a)(5)(ii)(B), and NIST CSF 2.0 DE.CM-09. * **CIS\_M365 §2.1.11 — "Ensure comprehensive attachment filtering is applied"** (CIS v6, Level 2) and Augmentt's own **COMPREHENSIVE\_ATTACHMENT\_FILTERING** check — this is the one check the Secure Score default template does **not** satisfy on its own, since 53 extensions falls well short of the \~184-extension reference list this control checks against (Augmentt's live evaluation requires more than 120 extensions plus sufficient overlap with the CIS reference list, `EnableFileFilter` on, and an enabled rule). Deploy the **CIS M365 V6 L2 - Comprehensive Attachment Filtering 2.1.11** template specifically to close this one out. * **CIS\_V8 §10.1 — "Deploy and Maintain Anti-Malware Software"** and **CIS\_V8 §9.7 — "Deploy and Maintain Email Server Anti-Malware Protections"**. {% hint style="info" %} Comprehensive attachment filtering is one of the handful of Defender checks Augmentt evaluates **directly against live tenant policy data** rather than through Microsoft Secure Score's 24–72 hour cache — it uses a superset-safe match, so any policy covering the full CIS reference list (not necessarily byte-for-byte identical) will pass. See the main [Defender](/modules/secure/defender.md) page's Compliance section. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/defender/anti-malware.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.