Exchange Online Protection (EOP)

Connect-ExchangeOnline -UserPrincipalName [email protected] # Tạo spam filter policy mức Strict New-HostedContentFilterPolicy -Name "VinaCorp-StrictSpam" ` -SpamAction Quarantine ` -HighConfidenceSpamAction Quarantine ` -PhishSpamAction Quarantine ` -HighConfidencePhishAction Quarantine ` -BulkThreshold 5 ` -BulkSpamAction MoveToJmf ` -QuarantineRetentionPeriod 30 ` -EnableLanguageBlockList $true ` -LanguageBlockList @("ar","zh","ru") ` -EnableRegionBlockList $false # Gắn policy vào rule (áp dụng cho all users) New-HostedContentFilterRule -Name "VinaCorp-StrictSpam-Rule" ` -HostedContentFilterPolicy "VinaCorp-StrictSpam" ` -RecipientDomainIs "vinacorp.vn" ` -Priority 0 Write-Host "Strict anti-spam policy created and applied"

# Tạo anti-malware policy chặn common attack attachments New-MalwareFilterPolicy -Name "VinaCorp-Malware" ` -EnableFileFilter $true ` -FileTypes @("ace","ani","apk","arj","bat","cab","cmd","com","cpl","dll", "exe","hta","jar","js","jse","msi","msp","pif","ps1","reg", "scr","vbe","vbs","wsf","wsh") ` -FileTypeAction Reject ` -Action DeleteMessage ` -EnableInternalSenderAdminNotifications $true ` -InternalSenderAdminAddress "[email protected]" New-MalwareFilterRule -Name "VinaCorp-Malware-Rule" ` -MalwareFilterPolicy "VinaCorp-Malware" ` -RecipientDomainIs "vinacorp.vn"

# Lấy CNAME records cần tạo trên DNS Get-DkimSigningConfig -Identity vinacorp.vn | Select-Object Domain, Selector1CNAME, Selector2CNAME # Sau khi tạo CNAME trên DNS provider, bật DKIM: Set-DkimSigningConfig -Identity vinacorp.vn -Enabled $true Write-Host "DKIM enabled for vinacorp.vn" # Kiểm tra trạng thái Get-DkimSigningConfig -Identity vinacorp.vn | Select-Object Domain, Enabled, Status

# Verify DNS records (chạy từ terminal hoặc PowerShell) Resolve-DnsName -Name "_dmarc.vinacorp.vn" -Type TXT | Select-Object Strings Resolve-DnsName -Name "vinacorp.vn" -Type TXT | Where-Object {$_.Strings -like "v=spf1*"} | Select-Object Strings

# Tạo quarantine policy cho phép user tự xem và release New-QuarantinePolicy -Name "HR_SelfRelease" ` -EndUserQuarantinePermissionsValue 23 ` -ESNEnabled $true # EndUserQuarantinePermissionsValue 23 = Allow: view + release + delete + block sender # ESNEnabled: gửi end-user spam notification email # Gán policy vào anti-spam policy Set-HostedContentFilterPolicy -Identity "VinaCorp-StrictSpam" ` -SpamQuarantineTag "HR_SelfRelease" ` -HighConfidenceSpamQuarantineTag "AdminOnlyAccessPolicy" Write-Host "Quarantine policy HR_SelfRelease configured"

# Xem email bị quarantine của HR dept (24h) Get-QuarantineMessage -RecipientAddress "[email protected]" | Where-Object {$_.ReceivedTime -gt (Get-Date).AddHours(-24)} | Select-Object Subject, SenderAddress, ReceivedTime, QuarantineTypes | Format-Table -AutoSize # Release email cụ thể $msgId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" Release-QuarantineMessage -Identity $msgId -ReleaseToAll Write-Host "Email released from quarantine"

# Chặn auto-forward email ra ngoài (data exfiltration prevention) New-TransportRule -Name "Block External Auto-Forward" ` -MessageTypeMatches AutoForward ` -SentToScope NotInOrganization ` -RejectMessageReasonText "Auto-forwarding to external recipients is not allowed." ` -RejectMessageEnhancedStatusCode "5.7.1" # Thêm [EXTERNAL] tag cho email từ bên ngoài New-TransportRule -Name "Tag External Email" ` -FromScope NotInOrganization ` -SetHeaderName "X-MS-Exchange-Organization-ExternalOriginator" ` -SetHeaderValue "1" ` -PrependSubject "[EXTERNAL] " Write-Host "Mail flow rules created"