MET

0.11.0

Checks/MDO/MET-MDO005-AntiMalware.ps1

                                $allMailboxes = $null

try {

    $allMailboxes = if ($METContext -and $METContext.AllMailboxes) { @($METContext.AllMailboxes) } else { @(Get-METAssessableMailboxes) }

    if ($METContext -and -not $METContext.AllMailboxes) { $METContext.AllMailboxes = $allMailboxes }

}

catch {

    New-METCheckResult -CheckId 'MET-MDO005' -Category MDO -Name 'Anti-Malware Effective Coverage' -Result Warning -Severity High -AffectedObject 'All Mailboxes' -Finding 'Unable to determine effective anti-malware coverage because the mailbox list could not be retrieved.' -Recommendation 'Ensure the account has Exchange View-Only Recipients permission and rerun the assessment.' -ReferenceUrl 'https://aka.ms/mdo-antimalware' -ErrorMessage $_.ToString()

    return

}

if ($allMailboxes.Count -eq 0) {

    New-METCheckResult -CheckId 'MET-MDO005' -Category MDO -Name 'Anti-Malware Effective Coverage' -Result NotApplicable -Severity High -AffectedObject 'Tenant (0 mailboxes)' -Finding 'No assessable mailboxes were found in the tenant.' -ReferenceUrl 'https://aka.ms/mdo-antimalware'

    return

}

$errors = [System.Collections.Generic.List[string]]::new()

try { $rules = @(Get-MalwareFilterRule -ErrorAction Stop) } catch { $rules=@(); $errors.Add("Unable to retrieve anti-malware rules. $($_.ToString())") }

try { $policies = @(Get-MalwareFilterPolicy -ErrorAction Stop) } catch { $policies=@(); $errors.Add("Unable to retrieve anti-malware policies. $($_.ToString())") }

try { $presets = @(Get-ATPProtectionPolicyRule -ErrorAction Stop) } catch { $presets=@(); $errors.Add("Unable to retrieve preset policy rules. $($_.ToString())") }

$groupCache = if ($METContext -and $METContext.GroupMembers) { $METContext.GroupMembers } else { @{} }

$resolution = Resolve-METEffectivePolicy -Subjects $allMailboxes -GroupCache $groupCache -Rules $rules -Policies $policies -PresetRules $presets -IncludePresets -PolicyLinkProperty MalwareFilterPolicy -ProtectionType 'anti-malware' -RetrievalErrors $errors

$evaluate = {

    param($policy, $policyType)

    $issues = [System.Collections.Generic.List[string]]::new()

    if (-not $policy) { $issues.Add('Policy settings could not be retrieved'); return $issues.ToArray() }

    if (-not $policy.ZapEnabled) { $issues.Add('ZAP for malware is disabled') }

    if (-not $policy.EnableFileFilter) { $issues.Add('Common attachment filter is disabled') }

    if ($policy.EnableFileFilter -and $policy.FileTypeAction -ne 'Reject') { $issues.Add("Common attachment action is '$($policy.FileTypeAction)' - recommended Reject") }

    if ($policy.EnableFileFilter -and $policy.PSObject.Properties['FileTypes']) {

        $configuredFileTypes = @(@($policy.FileTypes) | Where-Object { $_ } | ForEach-Object { $_.ToString().Trim().TrimStart('.').ToLowerInvariant() })

        if ($configuredFileTypes.Count -eq 0) {

            $issues.Add('Common attachment filter is enabled but its file type list is empty, so it blocks nothing')

        }

        else {

            $highRiskFileTypes = @('exe','com','scr','pif','cmd','bat','vbs','vbe','js','jse','wsf','wsh','hta','ps1','msi','lnk','jar','reg','cpl','dll')

            $missingFileTypes = @($highRiskFileTypes | Where-Object { $configuredFileTypes -notcontains $_ } | Sort-Object)

            if ($missingFileTypes.Count -gt 0) {

                $issues.Add("Common attachment filter does not block high-risk file types: $($missingFileTypes -join ', ')")

            }

        }

    }

    if ($policy.QuarantineTag -and $policy.QuarantineTag -ne 'AdminOnlyAccessPolicy') { $issues.Add("Malware quarantine policy is '$($policy.QuarantineTag)' - recommended AdminOnlyAccessPolicy") }

    $issues.ToArray()

}

New-METEffectivePolicyCoverageResult -CheckId 'MET-MDO005' -Name 'Anti-Malware Effective Coverage' -ProtectionType 'Anti-Malware' -Severity High -Subjects $allMailboxes -Resolution $resolution -GetPolicyIssues $evaluate -RetrievalErrors $errors -ReferenceUrl 'https://aka.ms/mdo-antimalware' -Recommendation 'Apply a Standard/Strict preset or a compliant custom anti-malware policy to every affected recipient. Enable malware ZAP and the common attachment filter, use Reject for blocked file types, and use the recommended malware quarantine policy.'