Comprehensive Attachment Filtering

<# .SYNOPSIS Comprehensive Attachment Filtering .DESCRIPTION Ensures both Malware Filter and Safe Attachments policies are configured. Provides layered protection against malicious attachments. .NOTES Filename: comprehensive-attachment-filtering.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Microsoft Defender for Office 365 .EXAMPLE .\comprehensive-attachment-filtering.ps1 -Monitoring Check if comprehensive filtering is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Comprehensive Attachment Filtering" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Comprehensive Attachment Filtering .DESCRIPTION Ensures both Malware Filter and Safe Attachments policies are configured. Provides layered protection against malicious attachments. .NOTES Filename: comprehensive-attachment-filtering.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Microsoft Defender for Office 365 .EXAMPLE .\comprehensive-attachment-filtering.ps1 -Monitoring Check if comprehensive filtering is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Comprehensive Attachment Filtering" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking Malware Filter policies..." -ForegroundColor Gray $malwarePolicies = Get-MalwareFilterPolicy -ErrorAction Stop Write-Host "Checking Safe Attachments policies..." -ForegroundColor Gray $safePolicies = Get-SafeAttachmentPolicy -ErrorAction Stop $result = @{ isCompliant = ($malwarePolicies.Count -gt 0 -and $safePolicies.Count -gt 0) malwarePolicies = $malwarePolicies.Count safePolicies = $safePolicies.Count } Write-Host "`n Layer 1 - Malware Filter Policies: $($result.malwarePolicies)" -ForegroundColor $( if ($result.malwarePolicies -gt 0) { "Green" } else { "Red" } ) if ($malwarePolicies.Count -gt 0) { foreach ($policy in $malwarePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Blocked file types: $($policy.FileTypes.Count)" -ForegroundColor Cyan } } Write-Host "`n Layer 2 - Safe Attachments Policies: $($result.safePolicies)" -ForegroundColor $( if ($result.safePolicies -gt 0) { "Green" } else { "Yellow" } ) if ($safePolicies.Count -gt 0) { foreach ($policy in $safePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Action: $($policy.Action)" -ForegroundColor Cyan Write-Host " Enabled: $($policy.Enable)" -ForegroundColor $( if ($policy.Enable) { "Green" } else { "Red" } ) } } else { Write-Host " ⚠️ Requires Microsoft Defender for Office 365 Plan 1 or 2" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Comprehensive protection enabled" -ForegroundColor Green exit 0 } else { if ($result.malwarePolicies -eq 0) { Write-Host "`n[FAIL] NON-COMPLIANT - Missing Malware Filter policies" -ForegroundColor Red } else { Write-Host "`n⚠️ PARTIAL - Safe Attachments not configured (requires license)" -ForegroundColor Yellow } exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Safe Attachments requires Defender for Office 365" -ForegroundColor Yellow Write-Host "`nTo configure:" -ForegroundColor Cyan Write-Host " 1. Ensure Defender for Office 365 Plan 1 or 2 license" -ForegroundColor Gray Write-Host " 2. Security & Compliance Portal > Threat management" -ForegroundColor Gray Write-Host " 3. Policy > Safe Attachments" -ForegroundColor Gray Write-Host " 4. Create policy:" -ForegroundColor Gray Write-Host " • Action: Block or Dynamic Delivery" -ForegroundColor Gray Write-Host " • Enable redirect: Yes" -ForegroundColor Gray Write-Host " • Redirect to: security team email" -ForegroundColor Gray Write-Host " • Applied to: All users" -ForegroundColor Gray Write-Host "`n📝 Safe Attachments scans files in real-time" -ForegroundColor Cyan Write-Host "Detonates suspicious files in sandbox environment" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking Malware Filter policies..." -ForegroundColor Gray $malwarePolicies = Get-MalwareFilterPolicy -ErrorAction Stop Write-Host "Checking Safe Attachments policies..." -ForegroundColor Gray $safePolicies = Get-SafeAttachmentPolicy -ErrorAction Stop $result = @{ isCompliant = ($malwarePolicies.Count -gt 0 -and $safePolicies.Count -gt 0) malwarePolicies = $malwarePolicies.Count safePolicies = $safePolicies.Count } Write-Host "`n Layer 1 - Malware Filter Policies: $($result.malwarePolicies)" -ForegroundColor $( if ($result.malwarePolicies -gt 0) { "Green" } else { "Red" } ) if ($malwarePolicies.Count -gt 0) { foreach ($policy in $malwarePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Blocked file types: $($policy.FileTypes.Count)" -ForegroundColor Cyan } } Write-Host "`n Layer 2 - Safe Attachments Policies: $($result.safePolicies)" -ForegroundColor $( if ($result.safePolicies -gt 0) { "Green" } else { "Yellow" } ) if ($safePolicies.Count -gt 0) { foreach ($policy in $safePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Action: $($policy.Action)" -ForegroundColor Cyan Write-Host " Enabled: $($policy.Enable)" -ForegroundColor $( if ($policy.Enable) { "Green" } else { "Red" } ) } } else { Write-Host " ⚠️ Requires Microsoft Defender for Office 365 Plan 1 or 2" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Comprehensive protection enabled" -ForegroundColor Green exit 0 } else { if ($result.malwarePolicies -eq 0) { Write-Host "`n[FAIL] NON-COMPLIANT - Missing Malware Filter policies" -ForegroundColor Red } else { Write-Host "`n⚠️ PARTIAL - Safe Attachments not configured (requires license)" -ForegroundColor Yellow } exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Comprehensive Attachment Filtering .DESCRIPTION Ensures both Malware Filter and Safe Attachments policies are configured. Provides layered protection against malicious attachments. .NOTES Filename: comprehensive-attachment-filtering.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Microsoft Defender for Office 365 .EXAMPLE .\comprehensive-attachment-filtering.ps1 -Monitoring Check if comprehensive filtering is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Comprehensive Attachment Filtering" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking Malware Filter policies..." -ForegroundColor Gray $malwarePolicies = Get-MalwareFilterPolicy -ErrorAction Stop Write-Host "Checking Safe Attachments policies..." -ForegroundColor Gray $safePolicies = Get-SafeAttachmentPolicy -ErrorAction Stop $result = @{ isCompliant = ($malwarePolicies.Count -gt 0 -and $safePolicies.Count -gt 0) malwarePolicies = $malwarePolicies.Count safePolicies = $safePolicies.Count } Write-Host "`n Layer 1 - Malware Filter Policies: $($result.malwarePolicies)" -ForegroundColor $( if ($result.malwarePolicies -gt 0) { "Green" } else { "Red" } ) if ($malwarePolicies.Count -gt 0) { foreach ($policy in $malwarePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Blocked file types: $($policy.FileTypes.Count)" -ForegroundColor Cyan } } Write-Host "`n Layer 2 - Safe Attachments Policies: $($result.safePolicies)" -ForegroundColor $( if ($result.safePolicies -gt 0) { "Green" } else { "Yellow" } ) if ($safePolicies.Count -gt 0) { foreach ($policy in $safePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Action: $($policy.Action)" -ForegroundColor Cyan Write-Host " Enabled: $($policy.Enable)" -ForegroundColor $( if ($policy.Enable) { "Green" } else { "Red" } ) } } else { Write-Host " ⚠️ Requires Microsoft Defender for Office 365 Plan 1 or 2" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Comprehensive protection enabled" -ForegroundColor Green exit 0 } else { if ($result.malwarePolicies -eq 0) { Write-Host "`n[FAIL] NON-COMPLIANT - Missing Malware Filter policies" -ForegroundColor Red } else { Write-Host "`n⚠️ PARTIAL - Safe Attachments not configured (requires license)" -ForegroundColor Yellow } exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Safe Attachments requires Defender for Office 365" -ForegroundColor Yellow Write-Host "`nTo configure:" -ForegroundColor Cyan Write-Host " 1. Ensure Defender for Office 365 Plan 1 or 2 license" -ForegroundColor Gray Write-Host " 2. Security & Compliance Portal > Threat management" -ForegroundColor Gray Write-Host " 3. Policy > Safe Attachments" -ForegroundColor Gray Write-Host " 4. Create policy:" -ForegroundColor Gray Write-Host " • Action: Block or Dynamic Delivery" -ForegroundColor Gray Write-Host " • Enable redirect: Yes" -ForegroundColor Gray Write-Host " • Redirect to: security team email" -ForegroundColor Gray Write-Host " • Applied to: All users" -ForegroundColor Gray Write-Host "`n📝 Safe Attachments scans files in real-time" -ForegroundColor Cyan Write-Host "Detonates suspicious files in sandbox environment" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Safe Attachments requires Defender for Office 365" -ForegroundColor Yellow Write-Host "`nTo configure:" -ForegroundColor Cyan Write-Host " 1. Ensure Defender for Office 365 Plan 1 or 2 license" -ForegroundColor Gray Write-Host " 2. Security & Compliance Portal > Threat management" -ForegroundColor Gray Write-Host " 3. Policy > Safe Attachments" -ForegroundColor Gray Write-Host " 4. Create policy:" -ForegroundColor Gray Write-Host " • Action: Block or Dynamic Delivery" -ForegroundColor Gray Write-Host " • Enable redirect: Yes" -ForegroundColor Gray Write-Host " • Redirect to: security team email" -ForegroundColor Gray Write-Host " • Applied to: All users" -ForegroundColor Gray Write-Host "`n📝 Safe Attachments scans files in real-time" -ForegroundColor Cyan Write-Host "Detonates suspicious files in sandbox environment" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Comprehensive Attachment Filtering .DESCRIPTION Ensures both Malware Filter and Safe Attachments policies are configured. Provides layered protection against malicious attachments. .NOTES Filename: comprehensive-attachment-filtering.ps1 Author: Nederlandse Baseline voor Veilige Cloud Requires: Microsoft Defender for Office 365 .EXAMPLE .\comprehensive-attachment-filtering.ps1 -Monitoring Check if comprehensive filtering is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Comprehensive Attachment Filtering" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking Malware Filter policies..." -ForegroundColor Gray $malwarePolicies = Get-MalwareFilterPolicy -ErrorAction Stop Write-Host "Checking Safe Attachments policies..." -ForegroundColor Gray $safePolicies = Get-SafeAttachmentPolicy -ErrorAction Stop $result = @{ isCompliant = ($malwarePolicies.Count -gt 0 -and $safePolicies.Count -gt 0) malwarePolicies = $malwarePolicies.Count safePolicies = $safePolicies.Count } Write-Host "`n Layer 1 - Malware Filter Policies: $($result.malwarePolicies)" -ForegroundColor $( if ($result.malwarePolicies -gt 0) { "Green" } else { "Red" } ) if ($malwarePolicies.Count -gt 0) { foreach ($policy in $malwarePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Blocked file types: $($policy.FileTypes.Count)" -ForegroundColor Cyan } } Write-Host "`n Layer 2 - Safe Attachments Policies: $($result.safePolicies)" -ForegroundColor $( if ($result.safePolicies -gt 0) { "Green" } else { "Yellow" } ) if ($safePolicies.Count -gt 0) { foreach ($policy in $safePolicies) { Write-Host " • $($policy.Name)" -ForegroundColor Gray Write-Host " Action: $($policy.Action)" -ForegroundColor Cyan Write-Host " Enabled: $($policy.Enable)" -ForegroundColor $( if ($policy.Enable) { "Green" } else { "Red" } ) } } else { Write-Host " ⚠️ Requires Microsoft Defender for Office 365 Plan 1 or 2" -ForegroundColor Yellow } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Comprehensive protection enabled" -ForegroundColor Green exit 0 } else { if ($result.malwarePolicies -eq 0) { Write-Host "`n[FAIL] NON-COMPLIANT - Missing Malware Filter policies" -ForegroundColor Red } else { Write-Host "`n⚠️ PARTIAL - Safe Attachments not configured (requires license)" -ForegroundColor Yellow } exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Safe Attachments requires Defender for Office 365" -ForegroundColor Yellow Write-Host "`nTo configure:" -ForegroundColor Cyan Write-Host " 1. Ensure Defender for Office 365 Plan 1 or 2 license" -ForegroundColor Gray Write-Host " 2. Security & Compliance Portal > Threat management" -ForegroundColor Gray Write-Host " 3. Policy > Safe Attachments" -ForegroundColor Gray Write-Host " 4. Create policy:" -ForegroundColor Gray Write-Host " • Action: Block or Dynamic Delivery" -ForegroundColor Gray Write-Host " • Enable redirect: Yes" -ForegroundColor Gray Write-Host " • Redirect to: security team email" -ForegroundColor Gray Write-Host " • Applied to: All users" -ForegroundColor Gray Write-Host "`n📝 Safe Attachments scans files in real-time" -ForegroundColor Cyan Write-Host "Detonates suspicious files in sandbox environment" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }