Ensure 'Blocked File Types' is configured to match the enterprise blacklist

MediumLevel 1Manual reviewsharepoint

Description

A common tactic of malware is to identify the type of malicious code protection software running on the system and deactivate it. Malicious code includes viruses, worms, Trojan horses, and Spyware. Manual review.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Central Administration > Security > Define blocked file types. For each web application (Change Web Application), compare the blocked list with the enterprise file-type blacklist; every blacklisted extension must be present. ($wa.BlockedFileExtensions lists them in PowerShell.)

How it is fixed

Fix method: Guidance or infrastructure patch

Central Administration > Security > Define blocked file types > select the web application > add each blacklisted extension (one per line) > OK. Repeat for every web application.

Properties

Operating systems: Any
Tags: sharepointmalware
Reference: CIS Microsoft SharePoint 2019 Benchmark v1.0.0 - 2.1 Ensure 'Blocked File Types' is configured to match the enterprise blacklist