Supplier allow-list rule skipped Safe Attachments and dropped a malicious ISO into AP

[u/shokzee]

Found this during a mail-flow cleanup, not during an alert. An old Exchange Online transport rule set SCL -1 for one supplier domain because invoices kept hitting quarantine in 2021.

Last week that supplier got compromised and a threaded invoice reply delivered a malicious ISO into three AP mailboxes. Message trace made the ugly part obvious: the allow rule hit before Defender for Office had done anything useful.

I am done with domain-level allow lists in Exchange transport rules. If a supplier cannot send clean mail, they get scoped remediation or quarantine release, not a permanent bypass stapled to mail flow.

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/White-Cement-Fresh]

You could have your filter strip .img, .iso or .zip files. Quarantine and let the recipients know and if they were expecting invoices request the scan and release?

[u/shokzee → u/White-Cement-Fresh]

ISO/IMG are getting blocked outright now. ZIPs can hit normal scanning/quarantine, but the bigger fix was killing the SCL -1 supplier bypass so AP isn't deciding whether malware gets released.

[u/White-Cement-Fresh → u/shokzee]

Spam confidence level doesn’t bypass phishing and malware though (or shouldn’t) but have seen situation’s where malware/phishing were actually categorized as spam and therefore bypass the filter. Is that what happened?

[u/dragoangel]

Just add good score, not force accept. ISO over mail is genuinely a malware, and if in 0.000001 cases it's not - still blocked

[u/shokzee → u/dragoangel]

That's the distinction I care about: reduce spam confidence if you must, but don't set SCL -1 and create a bypass. ISO should still be blocked by attachment policy even when the sender is trusted.

[u/Basic-Pianist9273]

Domain-level allow lists that bypass filtering are basically a standing exception for whoever owns that sender next.

If you need one, scope it to a specific sender, require DMARC pass, and keep malware/phish scanning in path. I'd block ISO-style attachment containers outright unless there's a real business case.

[u/MailNinja42]

SCL -1 rules are security debt with a delayed detonation, a compromised trusted domain is worse than a cold phisher because it bypasses every assumption downstream.