Malware Filter Policy Updates in Office 365

Posted on Posted in EOP, exchange online, Exchange Online Protection, malware, Office 365

In March I wrote a blog post that showed how to take the attachment filter list from Edge Server and add those attachment block types to EOP, as EOP had a very small list of attachments.

Today on one of my client tenants I noticed this precanned list of attachment extension types is now at 96 items, which is a considerable change from the list back in March 2017. The list in March was ace, ani, app, docm, exe, jar, reg, scr, vbe, vbs and still is for some tenants at the time of writing.

But while Microsoft has added new attachment types to the picker UI, there was no notification to the end client administrators that they might want to update their MalwareFilterPolicy to take account of these new attachment types that Microsoft have considered worthy of being blocked.

Therefore, now is the time to check your existing MalwareFilterPolicy to include the new extension types (listed below).

For reference, the new attachment filter types that have been added since March 2017 are

asp,cer,der,dll,dos,gadget,Hta,Inf,Ins,Isp,Its,Jse,Ksh,Lnk,mad,maf,mag,mam,maq,mar,mas,mat,mau,mav,maw,msh,msh1,msh1xml,msh2,msh2xml,mshxml,obj,os2,plg,pst,rar,tmp,vsmacros,vsw,vxd,w16,ws

But notice that some of these are initial capital versions of entries that are already there (i.e. hta was in the list or on Edge server a few months ago, but now Hta is on the list as well).

I am assuming attachment blocking is not case sensitive and so the following extensions are if added from the attachment list picker will be duplicates – Hta, Inf, Ins, Jse, Ksh if you imported a matching, but lower case, list from your Edge servers.

3 thoughts on “Malware Filter Policy Updates in Office 365

  1. The formatting of the site pushed some of those off the page, but I got the list from source.

    So you’re saying that the last list is going to appear in O365 by default at some point? Only the shorter list is showing here still, but the longer list includes some very strange choices, like w16, vsw, plg, obj, and some others that are also a bit of a stretch. It’s almost like someone used a list of possible extensions rather than a list of extensions that could possibly be dangerous. One of them is a log file (by a different name)! And it’s hard to believe that MS is going to block rar files, since they don’t block zip files.

    1. Thanks for the note on the formatting – made the long list work with WordPress today.

      As for if this list is coming to everyone, it is appearing in some of my tenants, so yes – but never as the default list – just the list that you can easily pick from. You can, via PowerShell add any extension that you want and I covered this in the March post on the subject – http://c7solutions.com/2017/03/exchange-edge-server-and-common-attachment-blocking-in-exchange-online-protection – where I added the default list from the Edge Server, but you could add anything to this list that you wanted to.

Leave a Reply

Your email address will not be published. Required fields are marked *