CIS.M365.7.3.1: Ensure Office 365 SharePoint infected files are disallowed for download

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.7.3.1
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	SharePoint
Related products	Defender
Feature	Access control
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 7.3.1 (L2, E5 Level 2)
Framework controls	cis-m365:7.3.1 nist-800-53-r5:SI-3 Malicious Code Protection
MITRE ATT&CK	T1080, T1204.002
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

7.3.1 (L2) Ensure Office 365 SharePoint infected files are disallowed for download

By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.

Rationale

Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization’s security team.

Impact

The only potential impact associated with implementation of this setting is potential inconvenience associated with the small percentage of false positive detections that may occur.

Remediation

PowerShell

1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com, replacing “tenant” with the appropriate value.
2. Run the following PowerShell command to set the recommended value:

Set-SPOTenant -DisallowInfectedFileDownload $true

Note: The Global Reader role cannot access SharePoint using PowerShell according to Microsoft. See the reference section for more information.

Default Value: False

Related Links

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365
• Overview of external sharing in SharePoint and OneDrive in Microsoft 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 496

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: Mynster9361. Open-source licences.