Body:
In the last related blog post we gave some introduction about Exchange Online Protection (EOP), what needs to be done when EOP is not working as desired and spam email troubleshooting process and classification. In this blog we will be moving further and discussing some more advanced option to stop spam emails.
1. IP Block list
The “IP block list” option enables us to block email messages that came from a specific mail server (specific IP).
EOP – using the the IP Block list
- Login to Office 365 portal, Exchange admin center
- On the left-side menu bar, choose the Protection menu
- On the top menu options, choose the connection filter menu
- Choose the Default connection filter policy
- In the window that appears, choose the option: connection filtering menu.
- In the section: IP block list, Choose the plus icon to add the IP address of the Mail server that sent the spam
Additional reading
2. International spam
The “International spam” is an interesting option that enables us to block or identify mail as “spam” based on the classification of Geographical location or Language.
Note: We need to be cautious when using this option because we can very easily get into the scenario in which legitimate mail is identified as “badspam” mail and be blocked.
Using the International spam option
- Login to Office 365 portal, Exchange admin center.
- On the left side menus, choose the protection menu
- On the top menu options, choose the content filter menu
- Choose the Default connection filter policy
- In the window that appears choose the option: international spam menu.
We can use one (or both) of the following options:
Blocking mail written in the specific language
- Choose Filter email messages written in the following languages
- Click on the Plus icon and choose the specific languages that you want to block
Blocking mail by Geographical location
- Choose Filter email messages sent from the following countries or regions
- Click on the Plus icon and choose the specific regions that you want to block
3. Content filter advanced options
Before we begin with instruction of how to use EOP advanced option for spam mail, let’s explore additional classifications of spam mail types and the tools we can use. Using a high level classification, we can define 3 “families” of spam mail types:
- Advertisement mail – negative effect of such mail could be considered as “annoying.” No real damage is caused to users besides the fact that the user is troubled by the content of the mail (suggestions to buy different medications, enlarge specific body parts and so on). This type of spam mail is automatically blocked (most of the time) by the Office 365 mail gateways. In case that some Advertisement spam mail manages to “sneak in” we can use a solution such as “rules” for blocking this type of spam mail.
- Mail with malicious content – this type of spam mail is closer to the definition of “virus” because, the target of the spammer is to cause the destination recipient to click or accept some suggestion that could lead the user to many kinds of attacks such as fraud, phishing and so on.
- “Other spam mail” – in this group, we have other spam mail types that don’t belong to the former families. As an example, we can mention spam mail described as NDR backscatter.
Content Filter – Advanced options
The “Advanced options” section under the Content Filter section enables us to “harden” the default spam policy that is implemented by the Office 365 mail security gateways. To avoid incorrectly marking legitimate messages as spam, we can use the “Test mode” (we can describe this as a “Learning mode”). This mode enables us to use the “additional security filter” and decide what will happen when a specific mail item is recognized as spam by the security filter without actually performing any action. We can choose to blockdelete the mail item or just report the mail item (Test mode).
Using Content Filter – Advanced options
- Login to Office 365 portal, Exchange admin center.
- On the left side menus, choose the protection menu
- On the top menu options, choose the content filter menu
- Choose the Default connection filter policy
- In the window that appears choose the option: advanced options menu.
As you can see there are many possible options that we can select. The options are divided into 2 categories: Increase spam Score and, Mark as spam.
To be able to demonstrate options available in the Content Filter – Advanced options let describe two scenarios:
- Scenario 1: Blocking spam mail with malicious content
- Scenario 2: Blocking spam mail classified as NDR backscatter
Scenario 1: Blocking spam mail with malicious content
Over the last month, users were complaining about spam mail that contains malicious content. When users open the mail item, they are automatically redirected to a web site, and once there are invited to download an executable file. To be able to block this spam mail item, we would activate three additional filters: mark as spam if the mail item is or contains:
Empty messages
JavaScript or VBScript in HTML
Frame or IFrame tags in HTML
By default, each of the security filter status is: Off. When we click on the “option arrow,” we can see that we can choose the options: “Off,” “On” or “Test.” In case that we choose the option “On,” each mail that contains content that is not allowed by one of the security filters that was selected (such as JavaScript or VBScript in HTML) will be marked as spam.
In case that we just want to test the “new security filter” we can choose the option “Test.” In the following screenshot, we can see that we can choose one of the following three options:
- None
- Add the default test X-header text
- Send a BCC message to this address (Note: This address should have a separate mailbox that is just for testing the security filters.)
Scenario 2: Blocking spam mail classified as NDR backscatter
NDR backscatter is a special kind of spam because the “mechanism” that’s used by the spammer is different from the “Standard spam mail.” NDR backscatter is when spammer forges the user’s email address and sends email on their behalf to other recipients. If the “destination mail system” recognizes the mail as a spam or if the mail is sent to non-existing users, the “destination mail system” creates an NDR message that is sent to the organization recipient (the user whose email address was used by the spammer).
Generally speaking, Office 365 security gateway servers are configured to block this kind of spam mails, but in case that the spam mail manages to “sneak” through, we can add the following filter using the Content Filter – Advanced options.
Using Content Filter – Advanced options – NDR backscatter
- Login to Office 365 portal, Exchange admin center.
- On the left side menus, choose the protection menu
- On the top menu options, choose the content filter menu
- Choose the Default connection filter policy
- In the window that appears choose the option: advanced option menu.
- Choose the option: NDR backscatter, and turn on the security filter
