Forum Discussion

AnuragSrivastava's avatar
AnuragSrivastava
Iron Contributor
Dec 06, 2020

ASR | Legit URL getting blocked

Hi,   A legit exchange url is getting blocked by defender and showing the action type as ExploitGuardNetworkProtectionBlocked. The event info says that the URL is blocked as Custom Policy by ASR.  ...
AnuragSrivastava's avatar
AnuragSrivastava
Iron Contributor
Dec 07, 2020

ehloworldio The URL was actually accessible before, it was just yesterday only when few machines were not able to access the URL while most of the machines were able to during the same time window.

SteBeSec's avatar
SteBeSec
Iron Contributor
Dec 13, 2020

AnuragSrivastava You can whitelist specific IPs and URLS via the Windows Defender Security Center (Defender ATP Portal): https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain

This should unblock these, even if they are blacklisted at Microsoft.

 

Why the IPs/URLs are now blacklisted only Microsoft can tell. Why this only happens on some machines is strange - I think it's best to open a support case about this behavior.

 

Best regards

Stefan

 

  • AnuragSrivastava's avatar
    AnuragSrivastava
    Iron Contributor
    Dec 13, 2020

    SteBeSec Thanks Stefan, I already allowed the URL via indicators. Yes, I agree might need to check with Microsoft on why the URL actually got blocked.