Microsoft 365 Safe Attachment data type

Question

Hi is there any document or list of what kind of data type that are scanned by safe attachment?

Is .rar type scanned too?

Answer 1

Hello

I am Abdal and I would be glad to help you with your question.

Yes, that's correct. Safe Attachments in Microsoft Defender for Office 365 scans .rar files, as well as other common archive file formats, for potentially malicious content. When a .rar file is received as an email attachment, it will be sent to the Safe Attachments environment for detonation and analysis, just like any other type of file.

The detonation process used by Safe Attachments involves running the attachment in a virtual environment that mimics a user's computer, without actually executing any potentially harmful code. This allows the system to detect any suspicious behavior that may indicate the presence of malware.

I hope this information helps.

Regards,

Abdal

Answer 2

So that means the .rar is scanned too right, just want to make sure, and because there's detonation/sandboxing process in safe attachment it means that all type of attachment will be detonated too?

Answer 3

Hi Ardan Z,

Thanks for responding, I appreciate it.

As far as I know, everything will get scanned.

It adds up another layer of scanning or filtering if you are going to use EOP.

Hopefully that answers your question.

Thanks & Best Regards, Louis

Answer 4

Hi Louis,

Thanks for your response. What I want to clarify is does safe attachment scans .rar file too? Is there any list of attachment type that doesn't get scanned by safe attachment or content filtering (if we talk about EOP)?

Answer 5

Hi Ardan Z,

My name is Louis and I am an independent Advisor.

Safe Attachments in Microsoft Defender for Office 365 provides an additional layer of protection for email attachments that have already been scanned by anti-malware protection in Exchange Online Protection (EOP). Specifically, Safe Attachments uses a virtual environment to check attachments in email messages before they're delivered to recipients (a process known as detonation).

Safe Attachments protection for email messages is controlled by Safe Attachments policies. Although there's no default Safe Attachments policy, the Built-in protection preset security policy provides Safe Attachments protection to all recipients (users who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies).

Kindly click this link for your reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-about?view=o365-worldwide

Hopefully, this helps.

Thanks & Best Regards, Louis