Safe Attachments and ZAP in Defender

Safe Attachments is a feature of Microsoft Defender for Office 365 that provides time-of-delivery protection against unknown malware in email attachments. Traditional antivirus relies on signature-based detection, which fails against zero-day malware. Safe Attachments uses a detonation chamber—a virtualized sandbox environment—to open and analyze attachments in real time before they reach the user's inbox. If the attachment exhibits malicious behavior, it is blocked, and the email is either quarantined or the attachment is replaced with a warning placeholder.

The feature exists because modern malware often uses polymorphic code, encryption, or delayed execution to evade signature-based scanners. By executing the attachment in a safe environment, Defender can observe its behavior (e.g., writing to disk, spawning processes, making network connections) and determine malicious intent.

When an email with an attachment arrives at Microsoft 365, the following sequence occurs:

4. Verdict and Action: The detonation produces a verdict: Malicious, Suspicious, or Clean. Depending on the policy action: - Block: The email is quarantined before delivery. The user never sees it. - Replace: The email is delivered, but the attachment is replaced with a file called "Malware Alert Text.txt" that warns the user. The original attachment is held for investigation. - Dynamic Delivery: The email body is delivered immediately, but the attachment is held until the detonation completes. Once the verdict is clean, the attachment is made available. This avoids delays for time-sensitive messages. - Allow: The email is delivered immediately, and detonation happens in the background. If later found malicious, ZAP may take action.

Safe Attachments policies are configured in the Microsoft 365 Defender portal at Email & collaboration > Policies & rules > Threat policies > Safe Attachments. You can also use PowerShell via Exchange Online PowerShell:

# Create a new Safe Attachments policy
New-SafeAttachmentPolicy -Name "BlockExecutables" -Enable $true -Action Block -Redirect $true -RedirectAddress admin@contoso.com

# Create a rule to apply the policy to all users
New-SafeAttachmentRule -Name "BlockExecutables Rule" -Policy "BlockExecutables" -RecipientDomainIs contoso.com

# View existing policies
Get-SafeAttachmentPolicy | Format-List Name, Action, Enable

# Check detonation results in Threat Explorer
Get-ThreatSubmission -SubmittedBy Microsoft -ThreatType Malware -Days 7

ZAP is a retroactive protection feature that automatically moves messages discovered to be malicious or phishing after delivery. It works by scanning messages that have already been delivered to user mailboxes and, if a threat is confirmed, moving the message to the Junk Email folder (for spam) or Quarantine (for malware/phishing).

#### How ZAP Works

#### Configuration

ZAP is enabled by default for malware and phishing. You can disable it or configure exceptions via policies in the Microsoft 365 Defender portal under Email & collaboration > Policies & rules > Threat policies > Anti-spam policies.

#### Key Points for Exam

Safe Attachments and ZAP work closely with: - Safe Links: Protects URLs in emails and Office documents. Safe Links checks URLs at time of click. - Anti-Phishing Policies: Protects against impersonation attacks. - Anti-Spam Policies: Filters bulk and spam messages. - Quarantine: Both features can send messages to quarantine for manual review. - Threat Explorer: Centralized investigation tool for all threats.

For example, if Safe Attachments detonates an attachment and finds it malicious, the email is blocked. However, if the email was delivered before the detonation (e.g., due to a delay), ZAP can retroactively remove it. Similarly, if a URL in an email is later found malicious by Safe Links, ZAP can move the email to quarantine.

A large bank uses Microsoft 365 with Defender for Office 365. The security team configures Safe Attachments with the "Block" action for all external emails. An employee receives an email with an invoice PDF that contains a zero-day exploit. The PDF is detonated in the sandbox, where it attempts to download a payload from a malicious domain. The sandbox flags it as malicious, and the email is quarantined before any user sees it. The security team receives an alert and investigates in Threat Explorer, finding that the same attachment was sent to 50 other users. They use the ZAP feature to ensure no copies exist (none were delivered due to blocking). The bank's policy also enables Dynamic Delivery for internal senders to avoid delays for legitimate attachments.

A marketing firm receives a phishing email with a malicious macro-enabled Word document. The attachment passes initial antivirus and Safe Attachments detonation because the macro is obfuscated and only triggers after 24 hours. The email is delivered with the attachment (Allow action). The next day, Microsoft's threat intelligence updates recognize the macro's behavior as malicious. ZAP scans the user's mailbox and finds the delivered email. It moves the email to quarantine and notifies the user. The security team investigates and finds that the attachment had a low reputation score. They adjust the Safe Attachments policy to use "Dynamic Delivery" for all external emails, which would have held the attachment until detonation completed (even if delayed).

Safe Attachments detonation introduces latency of 2-3 minutes per email. For high-volume environments, this can cause mail flow delays. Dynamic Delivery mitigates this by delivering the email body immediately. The detonation cluster scales automatically based on load. ZAP has minimal performance impact as it runs as a background process.