Malware and ransomware protection in Microsoft 365
Protecting Customer Data from Malware
Malware consists of viruses, spyware and other malicious software. Microsoft 365 includes protection mechanisms to prevent malware from being introduced into Microsoft 365 by a client or by a Microsoft 365 server. The use of anti-malware software is a principal mechanism for protection of Microsoft 365 assets from malicious software. The anti-malware software detects and prevents computer viruses, malware, rootkits, worms, and other malicious software from being introduced into any service systems. Anti-malware software provides both preventive and detective control over malicious software.
Each anti-malware solution in place tracks the version of the software and what signatures are running. The automatic download and application of signature updates at least daily from the vendor's virus definition site is centrally managed by the appropriate anti-malware tool for each service team.
The following functions are centrally managed by the appropriate anti-malware tool on each endpoint for each service team:
- Automatic scans of the environment
- Periodic scans of the file system (at least weekly)
- Real-time scans of files as they are downloaded, opened, or executed
- Automatic download and application of signature updates at least daily from the vendor's virus definition site
- Alerting, cleaning, and mitigation of detected malware
When anti-malware tools detect malware, they block the malware and generate an alert to Microsoft 365 service team personnel, Microsoft 365 Security, and/or the security and compliance team of the Microsoft organization that operates our datacenters. The receiving personnel initiate the incident response process. Incidents are tracked and resolved, and post-mortem analysis is performed.
Exchange Online Protection Against Malware
All email messages for Exchange Online travel through Exchange Online Protection (EOP), which quarantines and scans in real time all email and email attachments both entering and leaving the system for viruses and other malware. Administrators do not need to set up or maintain the filtering technologies; they are enabled by default. However, administrators can make company-specific filtering customizations using the Exchange admin center.
Using multiple anti-malware engines, EOP offers multilayered protection that's designed to catch all known malware. Messages transported through the service are scanned for malware (including viruses and spyware). If malware is detected, the message is deleted. Notifications may also be sent to senders or administrators when an infected message is deleted and not delivered. You can also choose to replace infected attachments with either default or custom messages that notify the recipients of the malware detection.
The following helps provide anti-malware protection:
- Layered Defenses Against Malware - Multiple anti-malware scan engines used in EOP help protect against both known and unknown threats. These engines include powerful heuristic detection to provide protection even during the early stages of a malware outbreak. This multi-engine approach has been shown to provide significantly more protection than using just one anti-malware engine.
- Real-time Threat Response - During some outbreaks, the anti-malware team may have enough information about a virus or other form of malware to write sophisticated policy rules that detect the threat even before a definition is available from any of the engines used by the service. These rules are published to the global network every 2 hours to provide your organization with an extra layer of protection against attacks.
- Fast Anti-Malware Definition Deployment - The anti-malware team maintains close relationships with partners who develop anti-malware engines. As a result, the service can receive and integrate malware definitions and patches before they are publicly released. Our connection with these partners often allows us to develop our own remedies as well. The service checks for updated definitions for all anti-malware engines every hour.
Microsoft Defender for Office 365
Microsoft Defender for Office 365 is an email filtering service that provides additional protection against specific types of advanced threats, including malware and viruses. Exchange Online Protection currently uses a robust and layered anti-virus protection powered by multiple engines against known malware and viruses. Microsoft Defender for Office 365 extends this protection through a feature called Safe Attachments, which protects against unknown malware and viruses, and provides better zero-day protection to safeguard your messaging system. All messages and attachments that don't have a known virus/malware signature are routed to a special hypervisor environment, where a behavior analysis is performed using a variety of machine learning and analysis techniques to detect malicious intent. If no suspicious activity is detected, the message is released for delivery to the mailbox.
Exchange Online Protection also scans each message in transit in Microsoft 365 and provides time of delivery protection, blocking any malicious hyperlinks in a message. Attackers sometimes try to hide malicious URLs with seemingly safe links that are redirected to unsafe sites by a forwarding service after the message has been received. Safe Links proactively protects your users if they click such a link. That protection remains every time they click the link, and malicious links are dynamically blocked while good links are accessible.
Microsoft Defender for Office 365 also offers rich reporting and tracking capabilities, so you can gain critical insights into who is getting targeted in your organization and the category of attacks you are facing. Reporting and message tracing allows you to investigate messages that have been blocked due to an unknown virus or malware, while the URL trace capability allows you to track individual malicious links in the messages that have been clicked.
SharePoint Online and OneDrive for Business Protection Against Ransomware
There are many forms of ransomware attacks, but one of the most common forms is where a malicious individual encrypts a user's important files and then demands something from the user, such as money or information, in exchange for the key to decrypt them. Ransomware attacks are on the rise, particularly those that encrypt files that are stored in the user's cloud storage. For more information about ransomware, see the Windows Defender Security Intelligence site.
Versioning helps to protect SharePoint Online lists and SharePoint Online and OneDrive for Business libraries from some, but not all, of these types of ransomware attacks. Versioning is enabled by default in OneDrive for Business and SharePoint Online. Since versioning is enabled in SharePoint Online site lists, you can look at earlier versions and recover them, if necessary. That enables you to recover versions of items that pre-date their encryption by the ransomware. Some organizations also retain multiple versions of items in their lists for legal reasons or audit purposes.
SharePoint Online and OneDrive for Business Recycle Bins
SharePoint Online administrators can restore a deleted site collection by using the SharePoint Online admin center. SharePoint Online users have a Recycle Bin where deleted content is stored. They can access the Recycle Bin to recover deleted documents and lists, if they need to. Items in the Recycle Bin are retained for 93 days. The following data types are captured by the Recycle Bin:
- Site collections
- List items
- Web Part pages
Site customizations made through SharePoint Designer are not captured by the Recycle Bin. For more information, see Restore deleted items from the site collection recycle bin. See also, Restore a deleted site collection.
Versioning does not protect against ransomware attacks that copy files, encrypt them, and then delete the original files. However, end-users can leverage the Recycle Bin to recover OneDrive for Business files after a ransomware attack occurs.
Recover from a Ransomware Attack
For the steps to recover from a ransomware attack in Microsoft 365, see Recover from a ransomware attack in Microsoft 365.
Key industry information:
- Human-operated ransomware
- The latest Microsoft Security Intelligence Report (see pages 22-24)
- Ransomware: A pervasive and ongoing threat report in the Threat analytics node of the Microsoft 365 Defender portal (see these licensing requirements)
Microsoft Security team blog posts:
See the Ransomware section.
Includes attack chain analysis of actual human-operated ransomware attacks.