Anti-phishing Beleid Voor Microsoft 365 In De Nederlandse Overheid

<# .SYNOPSIS Anti-phishing beleid: assessment, monitoring en remediatie voor Microsoft 365. .DESCRIPTION Controleert Microsoft Defender for Office 365 anti-phishing policies op kritieke instellingen zoals impersonation protection, mailbox intelligence, spoof intelligence en DMARC-acties. Script ondersteunt monitoring, assessment, remediatie en export en bevat een DebugMode voor lokale tests zonder verbinding met Microsoft 365 (conform Nederlandse Baseline voor Veilige Cloud). .NOTES Project : Nederlandse Baseline voor Veilige Cloud Author : Nederlandse Baseline voor Veilige Cloud Team Created : 2025-11-27 Version : 1.0.0 JSON : content/m365/threat-protection/anti-phishing-policies.json .LINK https://github.com/[org]/m365-tenant-best-practise .EXAMPLE .\anti-phishing-policies.ps1 -Monitoring Controleert alle anti-phishing policies, schrijft bevindingen naar de console en zet een exitcode. .EXAMPLE .\anti-phishing-policies.ps1 -Assessment Geeft een uitgebreid overzicht inclusief aanbevelingen voor CAB en audit. .EXAMPLE .\anti-phishing-policies.ps1 -Remediation -WhatIf Laat zien welke configuraties zouden worden toegepast zonder wijzigingen door te voeren. .EXAMPLE .\anti-phishing-policies.ps1 -Monitoring -DebugMode Voert een lokale testrun uit met voorbeelddata (duurt <15 seconden, geen cloudverbinding). #> [CmdletBinding()] param( [switch]$Monitoring, [switch]$Assessment, [switch]$Remediation, [switch]$Export, [string]$OutputPath, [switch]$WhatIf, [switch]$DebugMode ) $ErrorActionPreference = 'Stop' $script:ExchangeConnected = $false function Write-NbvcHeader { Write-Host "" Write-Host "===============================================" -ForegroundColor Cyan Write-Host "Anti-phishing policies – Nederlandse Baseline" -ForegroundColor Cyan Write-Host (Get-Date).ToString("yyyy-MM-dd HH:mm:ss") -ForegroundColor Cyan Write-Host "===============================================" -ForegroundColor Cyan } function Test-ModuleAvailability { if ($DebugMode) { Write-Verbose "DebugMode actief: modulecontrole wordt overgeslagen." return } if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) { throw "ExchangeOnlineManagement module ontbreekt. Installeer met Install-Module ExchangeOnlineManagement -Scope CurrentUser." } } function Connect-AntiPhishService { if ($DebugMode -or $script:ExchangeConnected) { return } Test-ModuleAvailability try { Write-Verbose "Verbinding maken met Exchange Online..." Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop | Out-Null $script:ExchangeConnected = $true } catch { throw "Kon niet verbinden met Exchange Online: $($_.Exception.Message)" } } function Get-DebugAntiPhishSnapshot { $policies = @( [pscustomobject]@{ Identity = "NBVC-AntiPhish-Core" Enabled = $true EnableTargetedUserProtection = $true EnableTargetedDomainsProtection = $true EnableOrganizationDomainsProtection = $true EnableMailboxIntelligence = $true EnableMailboxIntelligenceProtection = $true EnableSpoofIntelligence = $true EnableSimilarUsersSafetyTips = $true EnableSimilarDomainsSafetyTips = $true EnableUnusualCharactersSafetyTips = $true HighConfidencePhishAction = "Quarantine" PhishAction = "Quarantine" SpoofAction = "Quarantine" PhishThresholdLevel = 2 PriorityAccounts = @("minister@rijksoverheid.nl","cio@provincie.nl") ProtectedDomains = @("rijksoverheid.nl","provincie.nl") }, [pscustomobject]@{ Identity = "NBVC-AntiPhish-Exec" Enabled = $true EnableTargetedUserProtection = $true EnableTargetedDomainsProtection = $true EnableOrganizationDomainsProtection = $true EnableMailboxIntelligence = $true EnableMailboxIntelligenceProtection = $true EnableSpoofIntelligence = $true EnableSimilarUsersSafetyTips = $true EnableSimilarDomainsSafetyTips = $true EnableUnusualCharactersSafetyTips = $false HighConfidencePhishAction = "Quarantine" PhishAction = "Quarantine" SpoofAction = "Quarantine" PhishThresholdLevel = 1 PriorityAccounts = @("sg@ministerie.nl","dg@ministerie.nl") ProtectedDomains = @("ministerie.nl","rijksoverheid.nl") } ) $rules = @( [pscustomobject]@{ Identity = "NBVC-AntiPhish-Core-Rule" Enabled = $true AntiPhishPolicy = "NBVC-AntiPhish-Core" RecipientDomainIs = @("rijksoverheid.nl","provincie.nl") }, [pscustomobject]@{ Identity = "NBVC-AntiPhish-Exec-Rule" Enabled = $true AntiPhishPolicy = "NBVC-AntiPhish-Exec" RecipientDomainIs = @("rijksoverheid.nl") } ) return [pscustomobject]@{ Policies = $policies Rules = $rules DmarcRejectDomains = 2 } } function Get-AntiPhishSnapshot { if ($DebugMode) { Write-Verbose "DebugMode: retourneren van voorbeelddataset." return Get-DebugAntiPhishSnapshot } Connect-AntiPhishService $policies = Get-AntiPhishPolicy -ErrorAction Stop $rules = Get-AntiPhishRule -ErrorAction Stop $dmarcReject = 0 try { $acceptedDomains = Get-AcceptedDomain -ErrorAction Stop foreach ($domain in $acceptedDomains) { $dnsRecord = Resolve-DnsName -Name ("_dmarc." + $domain.DomainName) -Type TXT -ErrorAction SilentlyContinue if ($dnsRecord -and ($dnsRecord.Strings -join ";") -match "p=reject") { $dmarcReject++ } } } catch { Write-Verbose "Kon DMARC status niet bepalen voor alle domeinen: $($_.Exception.Message)" } return [pscustomobject]@{ Policies = $policies Rules = $rules DmarcRejectDomains = $dmarcReject } } function Test-AntiPhishBaseline { $snapshot = Get-AntiPhishSnapshot $result = [ordered]@{ Timestamp = Get-Date PoliciesEvaluated = 0 EnabledPolicies = 0 UserImpersonationCoverage = 0 DomainImpersonationCoverage = 0 MailboxIntelligenceCoverage = 0 SpoofIntelligenceCoverage = 0 SafetyTipsCoverage = 0 QuarantineCoverage = 0 DmarcRejectDomains = $snapshot.DmarcRejectDomains Issues = @() Warnings = @() Details = @() } $policies = $snapshot.Policies $rules = $snapshot.Rules if (-not $policies -or $policies.Count -eq 0) { $result.Issues += "Er zijn geen anti-phishing policies gevonden in de tenant." return [pscustomobject]$result } $result.PoliciesEvaluated = $policies.Count foreach ($policy in $policies) { $detail = [ordered]@{ Name = $policy.Identity Enabled = $policy.Enabled UserImpersonation = [bool]$policy.EnableTargetedUserProtection DomainImpersonation = [bool]($policy.EnableTargetedDomainsProtection -or $policy.EnableOrganizationDomainsProtection) MailboxIntelligence = [bool]($policy.EnableMailboxIntelligence -or $policy.EnableMailboxIntelligenceProtection) SpoofIntelligence = [bool]$policy.EnableSpoofIntelligence SafetyTips = [bool]($policy.EnableSimilarUsersSafetyTips -or $policy.EnableSimilarDomainsSafetyTips -or $policy.EnableUnusualCharactersSafetyTips) HighConfidenceAction = $policy.HighConfidencePhishAction PhishAction = $policy.PhishAction SpoofAction = $policy.SpoofAction Threshold = $policy.PhishThresholdLevel } if ($policy.Enabled) { $result.EnabledPolicies++ } else { $result.Issues += "Policy '$($policy.Identity)' is uitgeschakeld." } if ($detail.UserImpersonation) { $result.UserImpersonationCoverage++ } else { $result.Issues += "User impersonation staat uit in '$($policy.Identity)'." } if ($detail.DomainImpersonation) { $result.DomainImpersonationCoverage++ } else { $result.Issues += "Domain impersonation ontbreekt in '$($policy.Identity)'." } if ($detail.MailboxIntelligence) { $result.MailboxIntelligenceCoverage++ } else { $result.Warnings += "Mailbox intelligence is niet ingeschakeld voor '$($policy.Identity)'." } if ($detail.SpoofIntelligence) { $result.SpoofIntelligenceCoverage++ } else { $result.Issues += "Spoof intelligence is uitgeschakeld in '$($policy.Identity)'." } if ($detail.SafetyTips) { $result.SafetyTipsCoverage++ } else { $result.Warnings += "Safety tips staan uit bij '$($policy.Identity)'." } if ($detail.HighConfidenceAction -ne "Quarantine") { $result.Issues += "High confidence phishing actie is niet Quarantine in '$($policy.Identity)'." } else { $result.QuarantineCoverage++ } $result.Details += [pscustomobject]$detail } if (-not $rules -or ($rules | Where-Object { $_.Enabled }).Count -eq 0) { $result.Issues += "Er zijn geen actieve Anti-Phish rules gevonden. Policies hebben geen effect." } $missingAssignments = @() foreach ($rule in $rules) { if (-not $rule.Enabled) { $result.Warnings += "Rule '$($rule.Identity)' is uitgeschakeld." } if (-not $rule.RecipientDomainIs -or $rule.RecipientDomainIs.Count -eq 0) { $missingAssignments += $rule.Identity } } if ($missingAssignments.Count -gt 0) { $result.Issues += "Rules zonder domeintoewijzing: " + ($missingAssignments -join ", ") } if ($result.DmarcRejectDomains -eq 0) { $result.Warnings += "Geen enkel geaccepteerd domein heeft een DMARC p=reject record." } return [pscustomobject]$result } function Write-IssueList { param( [string]$Title, [System.Collections.IEnumerable]$Items, [ConsoleColor]$Color = [ConsoleColor]::Yellow ) if (-not $Items -or $Items.Count -eq 0) { return } Write-Host "" Write-Host $Title -ForegroundColor $Color foreach ($item in $Items) { Write-Host (" - {0}" -f $item) -ForegroundColor $Color } } function Export-AntiPhishReport { param( [Parameter(Mandatory)] [pscustomobject]$Result ) $resolvedPath = if ($OutputPath) { $OutputPath } else { Join-Path -Path (Get-Location) -ChildPath "anti-phishing-policies-report.json" } $Result | ConvertTo-Json -Depth 5 | Out-File -FilePath $resolvedPath -Encoding UTF8 Write-Host "Rapport opgeslagen op $resolvedPath" -ForegroundColor Cyan } function Invoke-AntiPhishMonitoring { $analysis = Test-AntiPhishBaseline Write-Host "" Write-Host "Policystatus: $($analysis.EnabledPolicies)/$($analysis.PoliciesEvaluated) actief" -ForegroundColor Cyan Write-Host "User impersonation coverage : $($analysis.UserImpersonationCoverage)" -ForegroundColor Cyan Write-Host "Domain impersonation coverage : $($analysis.DomainImpersonationCoverage)" -ForegroundColor Cyan Write-Host "Mailbox intelligence coverage : $($analysis.MailboxIntelligenceCoverage)" -ForegroundColor Cyan Write-Host "Spoof intelligence coverage : $($analysis.SpoofIntelligenceCoverage)" -ForegroundColor Cyan Write-Host "Safety tips coverage : $($analysis.SafetyTipsCoverage)" -ForegroundColor Cyan Write-Host "Policies met Quarantine : $($analysis.QuarantineCoverage)" -ForegroundColor Cyan Write-Host "DMARC p=reject domeinen : $($analysis.DmarcRejectDomains)" -ForegroundColor Cyan Write-IssueList -Title "Kritieke issues" -Items $analysis.Issues -Color Red Write-IssueList -Title "Waarschuwingen" -Items $analysis.Warnings -Color Yellow if (($analysis.Issues | Measure-Object).Count -eq 0 -and ($analysis.Warnings | Measure-Object).Count -eq 0) { Write-Host "`n✅ Anti-phishing policies voldoen aan de baseline." -ForegroundColor Green if ($Export) { Export-AntiPhishReport -Result $analysis } exit 0 } else { Write-Host "`n⚠️ Afwijkingen gevonden – raadpleeg log of voer -Remediation uit." -ForegroundColor Yellow if ($Export) { Export-AntiPhishReport -Result $analysis } exit 1 } } function Invoke-AntiPhishAssessment { $analysis = Test-AntiPhishBaseline Write-Host "`n== Samenvatting ==" -ForegroundColor Cyan Write-Host ("Policies geëvalueerd : {0}" -f $analysis.PoliciesEvaluated) Write-Host ("Enabled policies : {0}" -f $analysis.EnabledPolicies) Write-Host ("User impersonation cover : {0}" -f $analysis.UserImpersonationCoverage) Write-Host ("Domain impersonation : {0}" -f $analysis.DomainImpersonationCoverage) Write-Host ("Mailbox intelligence : {0}" -f $analysis.MailboxIntelligenceCoverage) Write-Host ("Spoof intelligence : {0}" -f $analysis.SpoofIntelligenceCoverage) Write-Host ("Safety tips : {0}" -f $analysis.SafetyTipsCoverage) Write-Host ("DMARC p=reject domeinen : {0}" -f $analysis.DmarcRejectDomains) Write-IssueList -Title "Kritieke issues" -Items $analysis.Issues -Color Red Write-IssueList -Title "Waarschuwingen" -Items $analysis.Warnings -Color Yellow Write-Host "`n== Detail per policy ==" -ForegroundColor Cyan foreach ($detail in $analysis.Details) { Write-Host ("{0} | Enabled:{1} | User:{2} | Domain:{3} | Mailbox:{4} | Spoof:{5} | Tips:{6} | HC:{7}" -f ` $detail.Name, $detail.Enabled, $detail.UserImpersonation, $detail.DomainImpersonation, $detail.MailboxIntelligence, $detail.SpoofIntelligence, $detail.SafetyTips, $detail.HighConfidenceAction) -ForegroundColor Gray } if ($Export) { Export-AntiPhishReport -Result $analysis } } function Invoke-AntiPhishRemediation { if ($DebugMode) { Write-Host "`nDebugMode: remediatie wordt gesimuleerd, er worden geen wijzigingen gemaakt." -ForegroundColor Yellow } else { Connect-AntiPhishService } $policyName = "NBVC-AntiPhish-Core" $ruleName = "NBVC-AntiPhish-Core-Rule" $protectedDomains = @() if (-not $DebugMode) { $protectedDomains = (Get-AcceptedDomain -ErrorAction Stop | Select-Object -ExpandProperty DomainName) } else { $protectedDomains = @("rijksoverheid.nl","provincie.nl") } if ($DebugMode) { Write-Host "Zou policy '$policyName' aanmaken of bijwerken met volledige beveiliging." -ForegroundColor Gray } else { $policy = Get-AntiPhishPolicy -Identity $policyName -ErrorAction SilentlyContinue if ($policy) { Write-Host "Bijwerken van bestaand beleid $policyName..." -ForegroundColor Cyan Set-AntiPhishPolicy -Identity $policyName ` -EnableTargetedUserProtection $true ` -EnableTargetedDomainsProtection $true ` -EnableOrganizationDomainsProtection $true ` -EnableMailboxIntelligence $true ` -EnableMailboxIntelligenceProtection $true ` -EnableSpoofIntelligence $true ` -EnableSimilarUsersSafetyTips $true ` -EnableSimilarDomainsSafetyTips $true ` -EnableUnusualCharactersSafetyTips $true ` -HighConfidencePhishAction Quarantine ` -PhishAction Quarantine ` -SpoofAction Quarantine ` -PhishThresholdLevel 2 ` -Enable $true ` -WhatIf:$WhatIf ` -ErrorAction Stop } else { Write-Host "Aanmaken van policy $policyName..." -ForegroundColor Cyan New-AntiPhishPolicy -Name $policyName ` -EnableTargetedUserProtection $true ` -EnableTargetedDomainsProtection $true ` -EnableOrganizationDomainsProtection $true ` -EnableMailboxIntelligence $true ` -EnableMailboxIntelligenceProtection $true ` -EnableSpoofIntelligence $true ` -EnableSimilarUsersSafetyTips $true ` -EnableSimilarDomainsSafetyTips $true ` -EnableUnusualCharactersSafetyTips $true ` -HighConfidencePhishAction Quarantine ` -PhishAction Quarantine ` -SpoofAction Quarantine ` -PhishThresholdLevel 2 ` -Enable $true ` -WhatIf:$WhatIf ` -ErrorAction Stop | Out-Null } } if ($DebugMode) { Write-Host "Zou rule '$ruleName' aanmaken met domeinen: $($protectedDomains -join ', ')" -ForegroundColor Gray } else { $rule = Get-AntiPhishRule -Identity $ruleName -ErrorAction SilentlyContinue if ($rule) { Write-Host "Bijwerken van rule $ruleName..." -ForegroundColor Cyan Set-AntiPhishRule -Identity $ruleName ` -AntiPhishPolicy $policyName ` -RecipientDomainIs $protectedDomains ` -Enabled $true ` -Priority 0 ` -WhatIf:$WhatIf ` -ErrorAction Stop | Out-Null } else { Write-Host "Aanmaken van rule $ruleName..." -ForegroundColor Cyan New-AntiPhishRule -Name $ruleName ` -AntiPhishPolicy $policyName ` -RecipientDomainIs $protectedDomains ` -Enabled $true ` -Priority 0 ` -WhatIf:$WhatIf ` -ErrorAction Stop | Out-Null } } Write-Host "`nRemediatie voltooid. Controleer CAB-notulen en DMARC-rapportages om compliance te bevestigen." -ForegroundColor Green } try { Write-NbvcHeader if ($Remediation) { Invoke-AntiPhishRemediation } elseif ($Monitoring) { Invoke-AntiPhishMonitoring } elseif ($Assessment) { Invoke-AntiPhishAssessment } elseif ($Export) { $analysis = Test-AntiPhishBaseline Export-AntiPhishReport -Result $analysis } else { Invoke-AntiPhishAssessment } } catch { Write-Host "`n❌ Fout: $($_.Exception.Message)" -ForegroundColor Red exit 2 } finally { if ($script:ExchangeConnected -and -not $DebugMode) { Disconnect-ExchangeOnline -Confirm:$false | Out-Null } Write-Host "`n===============================================" -ForegroundColor Cyan }