ASR | Legit URL getting blocked

[AnuragSrivastava]

Hi,

A legit exchange url is getting blocked by defender and showing the action type as ExploitGuardNetworkProtectionBlocked. The event info says that the URL is blocked as Custom Policy by ASR. 

Though the error is encountered only on few of the machines in my environment and not all of them. As of now, I have allowed that particular URL via Indicators in MDATP Security Center.

Request is someone can help me understand the reason on why it was getting blocked and if I need to revisit any ASR policies on Intune.

Appreciate any help here.

Thanks.

[#2]

@AnuragSrivastava based on what I understand 

Network protection expands the scope of Microsoft Defender SmartScreen to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).

[#3]

@ehloworldio The URL was actually accessible before, it was just yesterday only when few machines were not able to access the URL while most of the machines were able to during the same time window.

[#4]

@AnuragSrivastava You can whitelist specific IPs and URLS via the Windows Defender Security Center (Defender ATP Portal): https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/indicator...

This should unblock these, even if they are blacklisted at Microsoft.

Why the IPs/URLs are now blacklisted only Microsoft can tell. Why this only happens on some machines is strange - I think it's best to open a support case about this behavior.

Best regards

Stefan

[#5]

@SteBeSec Thanks Stefan, I already allowed the URL via indicators. Yes, I agree might need to check with Microsoft on why the URL actually got blocked.

[#6]

@AnuragSrivastava We have had various legit domains (e.g. zoom.us which is a sanctioned meeting tool) blocked at random for different users at different times.

This is even when domains are explicitly allowed in MDATP Security Center.

MS are continuing to troubleshoot, but it is seeming like an issue with SmartScreen URL lists rather than Defender/MCAS. 

The inconsistency is not very assuring however. 

[#7]

Ah and we also had Outlook getting blocked at one point. Turned out MS had added officeclient.microsoft.com to the listed URLs of OneDrive (consumer) in MCAS, which are automatically passing to Defender to block... They have removed it now, but seemingly it is still an immature product.

[#8]

@sewtom So did you open ticket with Microsoft to fix the same? It would be good to know and understand what actually is the reason behind the blocking of these legit URLs and that too for just few users.

[#9]

Nope, the case has been ongoing for several weeks. Several things have been tried but we don't yet know the true cause. Will try to remember to update here when I know :)

[#10]

You might see this if you are using the web content filtering in Defender for Endpoint. Check the web protection reports and you might see that URL being blocked by one of the web content filtering categories.

[#11]

Thanks yes we are using that but that was only part of the issue. Disabling 'unknown' categories has helped (it's in beta apparently) but we still have other issues with explicitly allowed sites getting blocked.

It seems a combination of conflict with SmartScreen and browser cache, however.

[#12]

@sewtom 

Over a year later and we're seeing the same issue. Site was tagged as pornography, it wasn't. Created an exception and it is still blocked. 

[#13]

Wow, really?
How did you register the URL in the indicator, and what browser did this happen in?

[#14]

Allow network indicator will allow you to override however there is a delay for it to hit the endpoint (up to 2 hours) doc'd here: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=o...
Please be sure to dispute the category in the UI as doc'd here:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-content-filtering?view...

Thanks,
Jake Mowrer

[#15]

@Jonhed Sorry, didn't see your reply until now. It was being blocked by any browser. Turns out I was just impatient. Waited until the next day and it was no longer blocked. 

[#16]

A link to the Microsoft sales team at https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Foutlook.office365.com%2Fowa%2Fcale........... was blocked for me today.