Malware Filter Policy Updates in Office 365

Updated August 2022

In March 2017 I wrote a blog post that showed how to take the attachment filter list from Edge Server and add those attachment block types to EOP, as EOP had a very small list of attachments.

In June 2017 in one of my client tenants I noticed this precanned list of attachment extension types is now at 96 items, which is a considerable change from the list back in March 2017. The list in March 2017 was ace, ani, app, docm, exe, jar, reg, scr, vbe, vbs.

And in 2023 I wrote an article on updating the malware filter file types to a very long list, and including modifying the preset filters.

But while Microsoft has added new attachment types to the picker UI, there was no notification in 2017 to the administrators that they might want to update their MalwareFilterPolicy to take account of these new attachment types that Microsoft have considered worthy of being blocked. This was changed after the original writing of this blog post and now it is possible to add additional extensions, extensions of your choice and to enable blocking of attachments based on these extensions.

Therefore, now is the time to check your existing MalwareFilterPolicy to include the new extension types (listed below).

For reference, the new attachment filter types that have been added in March 2017 are

asp,cer,der,dll,dos,gadget,hta,inf,ins,isp,its,jse,ksh,lnk,mad,maf,mag,mam,maq,mar,mas,mat,mau,mav,maw,msh,msh1,msh1xml,msh2,msh2xml,mshxml,obj,os2,plg,pst,rar,tmp,vsmacros,vsw,vxd,w16,ws

Since 2017 and up to current time, Microsoft are adding more suggested file types for blocking, but not blocking them by default – for example .7z and .zip are now both in the list to select from and you can type into the Malware Filter Policy file type control your own extensions as well.

I am assuming attachment blocking is not case sensitive and so the following extensions are if added from the attachment list picker will be duplicates – Hta, Inf, Ins, Jse, Ksh if you imported a matching, but lower case, list from your Edge servers.

To turn on the attachment blocking (block attachments with the named file type extensions) as part of the malware filter policy (so block them even if they are not malware) you need to run the following:

$filetypes = (Get-MalwareFilterPolicy Default).FileTypes
$filetypes = $filetypes + "shtml" + "shtm"
# and to add many other file types
$filetypes = $filetypes + "ade" + "adp" + "cpl" + "app" + "bas" + "asx" + "bat" + "chm" + "cmd" + "com" + "crt" + "csh" + "exe" + "fxp" + "hlp" + "hta" + "inf" + "ins" + "isp" + "js" + "jse" + "ksh" + "lnk" + "mda" + "mdb" + "mde" + "mdt" + "mdw" + "mdz" + "msc" + "msi" + "msp" + "mst" + "ops" + "pcd" + "pif" + "prf" + "prg" + "ps1" + "ps11" + "ps11xml" + "ps1xml" + "ps2" + "ps2xml" + "psc1" + "psc2" + "reg" + "scf" + "scr" + "sct" + "shb" + "shs" + "url" + "vb" + "vbe" + "vbs" + "wsc" + "wsf" + "wsh" + "xnk" + "ace" + "ani" + "docm" + "jar" + "asp" + "cer" + "der" + "dll" + "dos" + "gadget" + "Hta" + "Inf" + "Ins" + "Isp" + "Its" + "Jse" + "Ksh" + "Lnk" + "mad" + "maf" + "mag" + "mam" + "maq" + "mar" + "mas" + "mat" + "mau" + "mav" + "maw" + "msh" + "msh1" + "msh1xml" + "msh2" + "msh2xml" + "mshxml" + "obj" + "os2" + "plg" + "pst" + "rar" + "tmp" + "vsmacros" + "vsw" + "vxd" + "w16" + "ws" + "apk" + "appx" + "cab" + "iso" + "library" + "lib" + "msix" + "mhtml" + "msixbundle" + "terminal" + "plugin" + "font" + "command" + "bundle"

# And then to apply the $filetypes list to the Default policy (sorted and duplicates removed)
$filetypes = $filetypes | Sort -Unique
Set-MalwareFilterPolicy Default -FileTypes $filetypes -EnableFileFilter $true