Attackers rotate between file types faster than most block lists are updated: when macros were blocked they moved to ISO images, then to OneNote, LNK, XLL add-ins, HTML attachments and, in late 2024, signed RDP configuration files. A risky file type is any format that can run code, launch another program, change system settings or carry other files past inspection when a user opens it. This guide is the cross type reference: which extensions are dangerous and why, what Outlook, Exchange Online Protection, Windows and browsers already block, where Mark of the Web (MOTW) fits, and how to build a layered allowlist for email, web downloads and endpoints. It is written for email, endpoint and security operations engineers. Single vectors have their own deep guides, linked throughout.
Key takeaways
- Block by default, allow by exception. Very few roles need to receive executables, scripts, disk images or add-ins by email; an allowlist of business file types ages better than a block list chasing the latest lure.
- Extensions lie, so inspect true type and containers. Gateways should match file content, look inside archives and treat password-protected archives as suspicious, because a renamed or zipped executable defeats extension rules.
- MOTW is the hinge for endpoint controls. Office macro blocking, SmartScreen and several attack surface reduction rules depend on the Zone.Identifier stream; every path that strips it (some archivers, sync clients, non-NTFS media) is a gap.
- Reduce what can run, not only what can arrive. Removing file associations for script hosts, disabling Windows Script Host where unused and application control close the gap when something slips past email and web filters.
- Measure what gets through. Track blocked and delivered attachment types, MOTW-less executions and user-reported files; the type mix shifts every few months.
The risky file type families
Group extensions by what they do on open rather than memorising lists. The families below cover what attackers have used in documented campaigns and what Microsoft's own block lists target.
| Family | Example extensions | What happens on open | Deep guide |
|---|---|---|---|
| Native executables and installers | .exe, .scr, .com, .pif, .cpl, .msi, .msp, .msu, .appx | Code runs directly or through an installer, with the user's rights | Application Allowlisting Guide |
| Script files | .vbs, .vbe, .js, .jse, .wsf, .wsh, .ps1, .bat, .cmd, .hta, .py | Interpreted by Windows Script Host (wscript, cscript), PowerShell, cmd or mshta | Malware Guide |
| Shortcuts and launchers | .lnk, .url, .website, .scf, .appref-ms, .search-ms, .library-ms, .settingcontent-ms | Point to a command, remote share or search location; can start a program with arguments | Malicious LNK Files Guide |
| Disk images and containers | .iso, .img, .vhd, .vhdx, .cab | Mount as a drive; historically contents did not inherit MOTW | ISO and Container File Malware Delivery Guide |
| Archives | .zip, .7z, .rar, self-extracting archives (SFX, usually .exe) | Hide contents from extension filters; MOTW propagation depends on the extractor; decompression bombs exhaust scanners | This guide |
| Office add-ins and macro formats | .xll, .xlam, .ppam, .docm, .xlsm, .vsmacros | Add-ins load native or VBA code when the application starts; macros run if enabled | Malicious Office Add-ins Guide, Office Macro Blocking Guide |
| Rich documents with embedded objects | .one, .chm, .mht, .mhtml, .rtf | Embedded files or scripts launched by a click; compiled HTML help runs script | OneNote Malware Delivery Guide |
| HTML and SVG attachments | .html, .htm, .svg, .shtml | Open in the browser; can assemble a payload locally or host a credential phishing page | HTML Smuggling Guide |
| Configuration and registration files | .rdp, .reg, .inf, .theme, .udl, .diagcab | Change settings or connect to a remote host on open | This guide |
| Runtime and legacy formats | .jar, .jnlp, .swf, .xbap, .application | Launch a Java, Flash or ClickOnce runtime if one is present | This guide |
Extensions in the news, briefly
- XLL: an Excel add-in that is a native Windows DLL loaded through the Excel C API; opening it can run code in the Excel process without the macro prompt users have learned to distrust. Outlook blocks .xll, and the Exchange Online Protection (EOP) common attachments filter includes it in its default list.
- RDP: a Remote Desktop connection file. Microsoft Threat Intelligence reported on 29 October 2024 that Midnight Blizzard sent thousands of spear-phishing emails to over 100 organisations carrying RDP files signed with a Let's Encrypt certificate. Opening one connected the victim to an attacker-controlled server and redirected drives, clipboard, printers, smart cards and Windows Hello to it. Microsoft recommended restricting outbound RDP to external networks with Windows Firewall. Note that .rdp is not in Outlook's built-in blocked list.
- JNLP and JAR: Java Web Start launch files and Java archives. Both are blocked by Outlook. Java Web Start was removed from Java SE 11, but older runtimes remain on many desktops, so a .jnlp still works where Java 8 is installed.
- VBS and other WSH scripts: Microsoft lists VBScript as deprecated (announced October 2023) and says it will become a feature on demand before removal. Until then, a .vbs double-click runs in wscript.exe on every Windows desktop.
- SWF: Adobe Flash reached end of life at the end of 2020 and browsers no longer run it. Chrome's own policy text cites "all SWF downloads" as an example of a dangerous file type. Treat .swf as unneeded rather than as an active vector.
- DMP: a Windows memory dump. The risk is outbound, not inbound: a dump of a process such as lsass can contain credentials, so .dmp files leaving the estate by email or upload deserve a data loss prevention rule.
- 3GP: a mobile video container. It does not execute code by itself; risk comes from media parser vulnerabilities, so patch players rather than block the type.
- Zip bombs: archives that expand to enormous sizes or deeply nested layers to exhaust a scanner's memory, disk or time budget. Gateways should cap decompressed size, ratio and nesting depth, and treat "could not scan" as a block or quarantine, not a pass.
What the platforms already block
Outlook
Microsoft's support article "Blocked attachments in Outlook" lists the extensions Outlook will not let users open, including .exe, .scr, .msi, .bat, .cmd, .ps1, .vbs, .js, .wsf, .hta, .lnk, .url, .iso, .img, .vhd, .vhdx, .jar, .jnlp, .xll, .chm, .reg, .cpl, .appref-ms, .search-ms, .settingcontent-ms and the Python family (.py, .pyc, .pyw, .pyz). It does not list .zip, .one, .rdp, .html or .svg. For Exchange mailboxes an administrator can unblock types; for other accounts the article describes a registry change. Because the list lives in the client, it does nothing for webmail on unmanaged devices or for files reaching users through Teams, SharePoint or downloads.
Exchange Online Protection and gateways
The EOP anti-malware policy has a common attachments filter (Enable the common attachments filter, or -EnableFileFilter $true). Matching messages are rejected with a non-delivery report by default or quarantined (-FileTypeAction Reject|Quarantine), and the list is customised with -FileTypes. The default list includes types such as iso, img, lnk, hta, cab, vbs, wsf, xll and ppam; others, including one and vhd, are available to add. Microsoft documents that true type matching does not apply to some image formats (iso, img, vhd), which fall back to extension. Third-party secure email gateways offer the same building blocks: true file type detection, archive inspection to a set depth, handling of encrypted archives and sandbox detonation (Safe Attachments in Microsoft Defender for Office 365). See the Exchange Online Security Guide and the Email Gateway and Message Trace Detection Guide.
Browsers
Chrome's DownloadRestrictions policy has five values: 0 no special restrictions (default); 1 block malicious files and all dangerous file types; 2 also block uncommon or unwanted files; 3 block all downloads; 4 block malicious files only, which Google labels recommended. Values 1 and 2 are "only recommended" for users with a high tolerance for false positives. Microsoft Edge has an equivalent DownloadRestrictions policy, and Microsoft Defender SmartScreen adds reputation checks on downloaded files. SmartScreen does not cover files opened from internal shares. See the Browser Security Hardening Guide.
Mark of the Web
Windows adds MOTW as a Zone.Identifier alternate data stream to files from the Internet (ZoneId=3) or Restricted sites (ZoneId=4) zones, for example browser downloads and saved email attachments. It only exists on NTFS, not FAT32. Microsoft documents that files opened from OneDrive or SharePoint with "Open in Desktop App", files downloaded by the OneDrive sync client and files saved to a Trusted Location do not carry it, and Unblock-File removes it. Office macro blocking, Excel add-in loading and SmartScreen prompts all key off this stream. Archive tools vary in whether they copy it to extracted files (7-Zip added a "Propagate Zone.Id stream" option in version 22.00), and several MOTW bypass vulnerabilities, such as CVE-2022-41091 and CVE-2024-38217, are in the CISA Known Exploited Vulnerabilities catalog. ATT&CK tracks the abuse as T1553.005 Mark-of-the-Web Bypass.
Choosing a blocking strategy
| Approach | Strengths | Weaknesses | Best fit |
|---|---|---|---|
| Extension block list at the gateway | Quick, cheap, easy to explain | Defeated by renaming and archives; always one lure behind | Baseline for every organisation |
| True type plus archive inspection | Catches renamed and zipped executables | Fails open on encrypted archives unless configured; some types fall back to extension | Any organisation with a capable gateway |
| Inbound allowlist of business types | New file types are blocked by default | Needs an exception process; noisy for engineering and partner-facing teams | Regulated and high-risk organisations, executive mailboxes |
| Detonation sandbox | Finds malicious behaviour in permitted types | Delay; evasion by time checks and user interaction | Documents and archives you cannot block |
| Endpoint association and execution control | Works whatever the delivery channel (email, Teams, USB, web) | Needs testing against line-of-business tools | Everyone; the backstop |
- Small organisations: turn on the built-in common attachments filter with quarantine, add .one, .vhd, .vhdx, .rdp, .svg and .html, set the browser download policy, and deploy the attack surface reduction rules in audit then block. That covers most commodity lures.
- Large organisations: add an inbound allowlist for high-risk mailboxes, quarantine encrypted archives with a release workflow, and use application control so a file that arrives by any route still cannot run.
- Engineering and partner teams: rather than unblocking executables in email, provide a sanctioned exchange route (a managed file transfer or repository) where files are scanned and logged.
Endpoint controls that back up the filters
- Change default handlers: associate .js, .jse, .vbs, .vbe, .wsf, .wsh, .hta and .iso with Notepad or nothing through Group Policy preferences or Intune, so a double-click opens text instead of running script. ATT&CK mitigation guidance for T1553.005 recommends unregistering container extensions where they are not needed.
- Disable Windows Script Host where no supported software uses it, and plan for VBScript's removal now by inventorying scripts that call wscript or cscript.
- Attack surface reduction rules: "Block executable content from email client and webmail", "Block JavaScript or VBScript from launching downloaded executable content" and "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" target exactly these file families. Start in audit mode (event 1122) and move to block (event 1121).
- Application control: App Control for Business (WDAC) or AppLocker policies that cover scripts, MSI and DLLs stop a file from running even when it was delivered. See App Control for Business (WDAC).
- Office trust settings: require application add-ins to be signed by a trusted publisher and keep "Block macros from running in Office files from the Internet" enabled.
- Remove unneeded runtimes: uninstall old Java runtimes and any Flash remnants; each one keeps a file family alive.
- Outbound RDP: restrict outbound TCP 3389 and RDP to external networks at the host and perimeter firewall, which also neutralises rogue .rdp files.
Rolling it out
- Baseline: export 30 to 90 days of attachment types from message trace and download telemetry; list which types are actually received by which departments.
- Quick wins: enable the common attachments filter in quarantine mode with the default list plus the additions above; set browser download restrictions to block malicious downloads.
- Pilot ring: apply the extended list and endpoint association changes to IT and security staff for two weeks; record exceptions requested.
- Audit mode: run the attack surface reduction rules and application control in audit across the estate, review event 1122 and audit logs, and add justified exclusions.
- Enforce in rings: move to block by department, highest risk first, with a published exception route and a named owner for each exception.
- Rollback: keep the previous policy version; gateway file filters and Intune or Group Policy settings can be reverted in minutes, so define who can authorise a rollback and how it is logged.
- Review quarterly: compare blocked types with threat reporting and add new lure formats.
Detection and measurement
| Signal | Source | Why it matters |
|---|---|---|
| Attachment type and verdict per message | Gateway logs, message trace | Shows which risky types are still delivered |
| Office, Outlook or a browser spawning wscript, cscript, mshta, powershell or rundll32 | EDR process events, ASR block and audit events | Classic sign of a script or shortcut launched from a document or download |
| Disk image mounts by users | Microsoft-Windows-VHDMP-Operational log, EDR | ISO and VHD delivery |
| Zone.Identifier stream creation and absence on executed files | Sysmon event ID 15, EDR | Executables run without MOTW indicate a bypass path |
| Outbound RDP to the internet | Firewall, NetFlow | Rogue .rdp attachment use |
| Outbound .dmp, .pst or archive uploads | DLP, web proxy | Data and credential exfiltration |
- Delivered risky types: messages delivered with a type on your block list or outside your allowlist per month (target zero).
- Unscannable attachments: share of encrypted or oversized archives released without scanning.
- ASR coverage: percentage of endpoints with the three file-related rules in block mode.
- Script host executions from user-writable paths per 1,000 endpoints, trending down.
- Time to add a new lure type to gateway and endpoint controls after it appears in threat reporting.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1553.005 Mark-of-the-Web Bypass, T1027.006 HTML Smuggling, T1059.005 Visual Basic, T1059.007 JavaScript, T1218.005 Mshta, T1137.006 Add-ins | Delivery and execution techniques these controls interrupt |
| NIST SP 800-53 Rev. 5 | SI-3 Malicious Code Protection, SC-44 Detonation Chambers, CM-7(5) Allow-by-exception, SC-18 Mobile Code | Filtering, sandboxing and execution allowlisting |
| NIST CSF 2.0 | DE.CM-09, PR.PS-01 | Monitoring for adverse content; configuration management of handlers and policies |
| CIS Controls v8.1 | Control 9 (email and web browser protections, including blocking unnecessary file types), Control 10 (malware defences), Control 2 (software inventory and allowlisting) | Safeguards for attachment filtering and execution control |
| ISO/IEC 27001:2022 Annex A | A.8.7 Protection against malware, A.8.23 Web filtering | Control objectives the programme evidences |
See the CIS Control 9 Email and Web Browser Protections Guide.
Common failure patterns
- Blocking .exe but allowing .zip with an .exe inside: without archive inspection, an extension filter sees only the outer file.
- Letting encrypted archives through: a password in the email body defeats scanning; quarantine and release on request.
- Relying on Outlook's list alone: it does not reach webmail, Teams, SharePoint or browser downloads, and it does not include .one, .rdp, .html or .svg.
- Unblocking a type for one team globally: exceptions should be scoped to named recipients and senders, with an expiry.
- Assuming MOTW is always present: sync clients, Trusted Locations, non-NTFS media and some archivers drop it, which silently disables macro and add-in protection.
- Treating "scan failed" as clean: zip bombs and oversized files are designed to make scanners give up.
Practitioner checklist
- Enable the gateway file filter in quarantine mode and extend it with .one, .vhd, .vhdx, .rdp, .html and .svg where business allows.
- Turn on true type detection and archive inspection, and quarantine encrypted or unscannable archives.
- Set browser download restrictions by policy, and keep SmartScreen or Safe Browsing on.
- Reassociate script and disk image extensions to Notepad, and disable Windows Script Host where unused.
- Deploy the three file-related attack surface reduction rules, audit first, then block.
- Back the filters with application control covering scripts and installers.
- Block outbound RDP to the internet and remove unused Java runtimes.
- Review delivered attachment types monthly and add new lure formats within a set time.
Standards and references
- Microsoft Support: Blocked attachments in Outlook
- Microsoft Learn: Anti-malware protection in EOP
- Microsoft Learn: Macros from the internet are blocked by default in Office
- Microsoft Learn: Attack surface reduction rules reference
- Google: Chrome Enterprise policy DownloadRestrictions
- Microsoft Learn: Deprecated features for Windows client
- Microsoft Security Blog: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
- MITRE ATT&CK: Mark-of-the-Web Bypass (T1553.005)
Related NHI Mgmt Group resources: Malicious Office Add-ins Guide · ISO and Container File Malware Delivery Guide · HTML Smuggling Guide · Malicious LNK Files Guide