Misconfiguration Spotlight: The Default Blocked File Extensions List Is Not a Security Policy — It’s a Starting Point

Microsoft gave you a lock. You assumed it covered every door.

Exchange Online Protection’s common attachments filter ships with a default list of blocked file extensions — roughly 50 types pre-selected out of over 200 available. Most organizations enable it, see .exe, .bat, and .scr on the list, and move on. This is a dangerous misconception. The default list is a baseline, not a perimeter. The file types it doesn’t block are precisely the ones attackers are exploiting right now.

Estimated reading time: 6 minutes

Why This Persists

It’s a classic case of “enabled” being confused with “configured.” The common attachments filter is toggled on automatically in tenants created after late 2023, and the admin sees a healthy-looking list of blocked types. There’s no warning banner saying “you’re leaving 150+ dangerous file types unblocked.” Most admins never revisit the list — because nothing appears broken. And when security teams are stretched thin across identity, endpoint, and cloud, the email attachment filter rarely gets a second look.

Real-World Risks

OneNote as a Malware Mule (.one)

The .one extension — Microsoft’s own OneNote file format — wasn’t on the default block list when attackers began weaponizing it in early 2023. Threat actors discovered they could embed HTA, LNK, and batch scripts inside a OneNote file, hide them behind a fake “Click to View” button, and deliver banking trojans, infostealers, and ransomware loaders directly through email. Because OneNote is installed by default with every Office/M365 deployment, the file format was trusted implicitly by both email gateways and users.

Disk Images Bypass Mark-of-the-Web (.iso, .img, .vhd)

ISO and IMG files have been a favorite delivery mechanism for malware operators looking to evade both email filters and endpoint protections. When a user double-clicks an ISO, Windows auto-mounts it as a virtual drive — and the files inside historically didn’t inherit Mark-of-the-Web flags, meaning SmartScreen warnings were suppressed. Attackers used this to deliver IcedID, Cobalt Strike beacons, and ransomware payloads through what looked like a simple email attachment.

Macro-Enabled Office Variants Flying Under the Radar (.xlsm, .dotm, .pptm)

Microsoft blocked VBA macros in files from the internet by default in 2022 — a huge improvement. But many macro-enabled Office formats like .xlsm aren’t pre-selected in the EOP default block list, even though the true-type detection engine can identify them. If your anti-malware policy only blocks what the defaults prescribe, these formats can still reach inboxes, where social engineering takes over.

Archive and Container Formats as Trojan Horses (.7z, .arj, .cab, .wim)

Less common archive formats often sail through default filters. Attackers have used .wim (Windows Imaging Format) files to deliver Agent Tesla and other RATs, banking on the fact that uncommon archive types aren’t scrutinized by most email security stacks. If your blocked extensions list only covers .exe inside an obvious zip, you’re missing a significant attack surface.

Case Studies

Qakbot / OneNote Campaign (January–June 2023) Starting in late January 2023, the threat group TA577 (also tracked as MALLARD SPIDER) began mass-distributing Qakbot malware through .one file attachments and embedded links to OneNote notebooks. The campaign used thread-hijacking — injecting malicious replies into existing email conversations — to build trust. Once a user clicked the embedded “Open” button inside the OneNote file, an HTA script downloaded a Qakbot DLL, which then served as a staging platform for Cobalt Strike and, ultimately, ransomware like BlackBasta. Proofpoint detected over 50 OneNote-based campaigns in January 2023 alone, impacting organizations worldwide. The FBI-led takedown of Qakbot’s infrastructure in August 2023 found the botnet had compromised over 700,000 machines and facilitated millions in ransomware payments.. Reference: Symantec — Qakbot Takedown Operation

IcedID via ISO → Quantum Ransomware (September 2022) Documented by The DFIR Report, this intrusion began when a victim received a malspam email containing a ZIP archive with an ISO file inside. The ISO — which evaded the common attachments filter and Mark-of-the-Web protections — contained a hidden directory with an IcedID payload and a deceptive LNK file. Within 16 hours of execution, Cobalt Strike beacons were active. The attackers exploited ZeroLogon (CVE-2020-1472), installed remote access tools, moved laterally across the domain, and deployed Quantum ransomware to all domain-joined systems within 78 hours of initial infection.. Reference: Reference: The DFIR Report

Consequences

Ransomware deployment across entire domains, triggered by a single attachment that the default filter was never configured to catch. The DFIR Report case went from email to domain-wide encryption in just over three days.

Credential theft and infostealer infections (Redline, AsyncRAT, Agent Tesla) that harvest browser-stored passwords, cryptocurrency wallets, and session tokens — creating persistent access that outlasts any single incident response.

Regulatory exposure under frameworks like GDPR, HIPAA, and PCI-DSS, where failure to implement reasonable email security controls becomes evidence of negligence in post-breach investigations.

Reputational damage when thread-hijacked emails — sent from your own compromised accounts — deliver malware to your customers, partners, and suppliers, turning your organization into an unwitting threat actor.

Supply-chain risk amplification, where a single successful infostealer infection provides credentials that enable lateral movement into shared SaaS platforms, cloud tenants, and partner environments.

Best Practices for Prevention

Audit and expand your blocked file types list immediately. Review the full set of 200+ available file types in Microsoft Defender’s anti-malware policy. At minimum, add: .one, .iso, .img, .vhd, .vhdx, .7z, .wim, .xlsm, .dotm, .pptm, .cab, and .arj. Use Get-MalwareFilterPolicy | Select -ExpandProperty FileTypes in Exchange Online PowerShell to see what you’re actually blocking today.

Layer transport rules on top of the anti-malware policy. The common attachments filter applies to both internal and external mail. If you need to block specific types only from external senders — or want custom rejection messages — create mail flow rules scoped to SentToScope NotInOrganization with clear NDR text explaining why the file was rejected.

Enable and verify true-type detection. EOP’s common attachments filter performs true-type matching, detecting file types by content rather than extension alone. But this only works for the types you’ve added to your policy. An .exe renamed to .txt will be caught — but only if .exe is on your list. Confirm your policy includes all executable and script types, not just the obvious ones.

Treat your blocked extensions list as a living document. Subscribe to Microsoft’s Message Center alerts for EOP updates. When Microsoft expanded the default list in mid-2022 from ~13 to ~53 pre-selected types, existing policies were not automatically updated. You had to manually add the new types. Set a quarterly calendar reminder to review the available file types and compare against current threat intelligence.

Test before you assume you’re protected. Send test emails with the file types you believe are blocked. You may be surprised. Anti-malware policies, OWA mailbox policies, and transport rules all have independent file type lists — a gap in any one of them can let an attachment through.

A default configuration is a vendor’s best guess at your security needs. Your actual threat surface is something only you can define. At Reclaim Security, we help you close the gap between what’s enabled and what’s enforced — because the attachments that get through are the ones nobody thought to block.