O365 - Block Malware file extensions

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This Playbook Provides the automation on blocking the suspicious/malicious file attachment on mails

Attribute	Value
Type	Playbook
Solution	Microsoft Defender for Office 365
Source	View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azuresentinel	Managed	1	2
keyvault	Managed	0	1
function	Built-in	0	4

Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action	Method	Endpoint	Other
Add_comment_to_incident_(V3)	post	/Incidents/Comment	—
Add_comment_to_incident_(V3)_2	post	/Incidents/Comment	—

keyvault (Managed)

Action	Method	Endpoint	Other
Get_secret	get	/secrets/@{encodeURIComponent(parameters('Certificate_key_name'))}/value	—

function (Built-in)

Action	Method	Endpoint	Other
BlockMalwareFileExtension	—	—	functionId=[concat(variables('o365FuntionsAppId'), '/functions/BlockMalwareFileExtension')]
ConnectExchangeOnline	—	—	functionId=[concat(variables('o365FuntionsAppId'), '/functions/ConnectExchangeOnline')]
DisconnectExchangeOnline	—	—	functionId=[concat(variables('o365FuntionsAppId'), '/functions/DisconnectExchangeOnline')]
ListMalwarePolicy	—	—	functionId=[concat(variables('o365FuntionsAppId'), '/functions/ListMalwarePolicy')]

Additional Documentation

📄 Source: O365DefenderPlaybooks/o365-BlockMalwareFileExtension/readme.md

o365-BlockMalwareFileExtension Info Playbook

Summary

When a new Microsoft Sentinel incident is created, this playbook gets triggered and performs below actions

1. Fetches the list of earlier blocked file extension .
2. Fetches the new file extension from incidents and compare them with existing one and update the blacklist .
   
   

Prerequisites

1. Defender for office 365 function app custom connector needs to be deployed prior to the deployment of this playbook under the same subscription.
2. Custom connector readme.md file should be followed properly before using any of the Defender for office 365 playbooks.

Deployment instructions

1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.

2. Fill in the required parameters:
   • Playbook Name: Enter the playbook name here
   • Applicationid: Enter the application ID , which you got during app registration.
   • Malware Policy Name : Enter the Malware policy name where file extension will be added .
   • Organization Name : Enter the organization name (ex : abc@pay.onmicrosoft.com then orgname will be : pay.onmicrosoft.com).
   • Key vault name : Your Key vault name where certificate thumbprint is saved.
   • Certificate_key_name : Your secret key name under which certificate thumbprint is stored.
   • Functions App Name : Enter your function app name (Default : o365def ,Recommend : don’t change it)

Post-Deployment instructions

a. Authorize connections (Perform this action if needed)

Once deployment is complete, you will need to authorize each connection.

1. Click the Microsoft Sentinel connection resource
2. Click edit API connection
3. Click Authorize
4. Sign in
5. Click Save
6. Repeat steps for all connections

b. Configurations in Sentinel

1. In Microsoft sentinel analytical rules should be configured to trigger an incident with risky Filename.
2. Configure the automation rules to trigger this playbook, mapping of Filename is necessary
3. Refer to Screenshot below

c. Assign Playbook Microsoft Sentinel Responder Role

1. Select the Playbook (Logic App) resource
2. Click on Identity Blade
3. Choose System assigned tab
4. Click on Azure role assignments
5. Click on Add role assignments
6. Select Scope - Resource group
7. Select Subscription - where Playbook has been created
8. Select Resource group - where Playbook has been created
9. Select Role - Microsoft Sentinel Responder
10. Click Save (It takes 3-5 minutes to show the added role.)

d. Assign access policy on key vault for Playbook to fetch the secret key

1. Select the Keyvault resource where you have stored the secret
2. Click on Access policies Blade
3. Click on Create
4. Under Secret permissions column , Select Get , List from "Secret Management Operations"
5. Click next to go to Principal tab and choose your deployed playbook name
6. Click Next leave application tab as it is .
7. Click Review and create
8. Click Create

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Microsoft Defender for Office 365