Troubleshoot Intra-Org Email Marked as Malware

Question

A user within our Microsoft 365 tenant sent an email to another user (intra-org) and the email was caught in quarantine for "Malware".

The detection technology is listed as "URL detonation reputation", however when I try to view details about the quarantined email it tells me there are no URLs. Even the URL tab in Explorer, shows that there is no URL data.

Reviewing the email in 'Explorer > Analysis > Related Entities' even shows "URL (Total Count) 0 (Threat) Yes".

This was an important email and now execs are needing an explanation as to what happened, and how we can prevent this from happening.

Are there any other ways for me to determine what happened with the email and find out why it was flagged as malware?

Answer 1

Hi Timothy_C,

Good day.

Hope you are doing well you for posting in Microsoft Community.

I’m sorry to hear that you encountered this issue with email quarantine. It sounds like a false positive detection by the URL detonation reputation feature, which analyzes URLs in email messages for malicious behavior. Sometimes, this feature can flag legitimate emails as malware if they contain links to websites that are not yet categorized or have a low reputation score.

For your query regarding Quarantine in M365, whether a detected message is quarantined by default depends on the following factors:

• The protection feature that detected the message. For example, the following detections are always quarantined:
  • Malware detections by anti-malware policies and Safe Attachments policies, including Built-in protection for Safe Attachments.
  • High-confidence phishing detections by anti-spam policies.
• Whether you're using the Standard and/or Strict preset security policies. The Strict profile quarantines more types of detections than the Standard profile.

To reduce the false positive quarantine emails, we'd suggest you:

1. Adjust the Anti-malware settings, for example: reduce the file types in the "common attachments filter"

2. Use the Microsoft 365 Defender portal to create Safe Attachments policies， put some trusted users' email addresses into the customized safe attachments policy:

3. Assign Standard preset security policies instead of Strict ones to users, refer to Preset security policies in EOP and Microsoft Defender for Office 365.
4. The last method is: to change the bulk email threshold or dd senders to the safe sender list as you already mentioned in the thread.

To investigate why your email was quarantined for Malware, kindly open a service request in the Microsoft 365 admin center Get support - Microsoft 365 admin | Microsoft Learn, the online support team will help you to investigate further by collecting the logs and checking from the back end.

I hope this helps let me know if this is contrary to what you need, I would still be helpful to answer more of your questions.

Best Regards

Microsoft Community

Answer 2

Hello Ben,

No, I haven't heard anything back from Microsoft yet. I submitted a ticket to them on January 16th to investigate why it was flagged and have not received a response.

We're in a similar situation where changing our policies isn't really an option for us, either. We still receive more spam & phishing than we'd like, so lowering the strength of any of the filters doesn't seem like a great idea.

If I do end up hearing anything from Microsoft, I'll be sure to post an update here in case others are experiencing the same issue.

Answer 3

Timothy, did you get to the bottom of this?

We have a similar issue which appears to have started around 11th-15th Jan!

Email from our software application (which sends transactional emails to its' users) has seemingly started having it's email quarantined due to 'High Confidence Phish' as determined by 'URL detonation reputation'. Simply changing our own polices is not an option as this affects our users who have their own 365 tenants!

Answer 4

Hello Eleni,

Thank you for the information. Your assistance is appreciated.

We are currently using the standard presets.

I'll follow up with Microsoft 365 support to see if they can help investigate why the email was flagged. I would like to know before I starts adjusting our filter policies.

Have a great day!

Answer 5

Dear Timothy_C,

Good day! Thank you for reaching out to the Microsoft Community. We appreciate your inquiry, and we are dedicated to assisting you promptly. Our team is actively reviewing your situation, and we will provide you with an update on the thread accordingly.

Your patience and understanding are valued, and we sincerely thank you for your time and cooperation.

Sincerely,

Libeamlak | Microsoft Community Moderator