You can enable and configure the common attachments filter (also known as common attachment blocking) as described in Common attachments filter in anti-malware policies.
You can also create an Exchange mail flow rule (also known as transport rule) that blocks any email attachment that has executable content.
Follow the steps in How to reduce malware threats through file attachment blocking in Exchange Online Protection to block the file types listed in Supported file types for mail flow rule content inspection in Exchange Online.
For increased protection, we also recommend using the Any attachment file extension includes these words condition in mail flow rules to block some or all of the following extensions: ade, adp, ani, bas, bat, chm, cmd, com, cpl, crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb, mde, mdz, msc, msi, msp, mst, pcd, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh.