I will continue my common scenarios series with an article about Zero Day Malware. We have seen this in the past several times and it affects the end-user, the network itself and also the business.
The reasons for receiving a zero-day malware are vast and to be proactive on such an issue, you do have some options to protect your organization:
- One of them was covered in a previous article Aggressive Malware Protection in Office 365
- Soon, Administrators will be able to block specific file types by using only a check-box. This is known as Common Attachment Blocking and you will see it in the near future on your Office 365 tenant. I will come back with an article about it as soon as it reaches public availability.
So, coming back to the issue, let's see how you can get reactive on this.
Add-RoleGroupMember -Identity "Discovery Management" -Member mihac
Log out and back in PowerShell as you will now have the Search-Mailbox command
To search messages and log the search results you would need to run the below commands
Search-Mailbox -Identity "mailbox you are looking to search" -SearchQuery 'Subject:"Subject of the message”' -TargetMailbox administrator -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
NOTE: (When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox)
Search-Mailbox -Identity "mailbox you are looking to search" -SearchQuery ' Subject:"Subject of the message"' –DeleteContent
The below command will delete messages based on a specific time frame, subject and looking at all mailboxes
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery '(received:07/21/2015..07/24/2015) AND (Subject:Subject of the message)' -DeleteContent -force
The following TechNet article provides additional information on hosted mailbox search: Search and delete messages.
Usually, a new malware will be blocked in about 24hrs. Bare in mind that Office 365 is using three different engines, one of which is Microsoft's one. You can submit the malware to our AV Analysts and a signature will be created for that and you can also check on VirusTotal what is the coverage of that particular file on all commercial AV engines with their latest updates.
Bare in mind that from the time that a signature was deployed for that particular malware, it will take a couple of hours to get these updates replicated to all Office365 servers.