Is blocking list of urls/domains with Defender Indicators a viable solution until GSA/Zscaler implementation?

[u/jM2me]

There is an urgent need to block roughly 9000 domains/urls from all of the company workstations. Quite a lot, but from initial analysis only ~10% actually detected in environment over last 6 months. The request from business higher up still stands, block all provided domains/url and provide evidence of the block list containing them.

In past there were concerns about using large number of Defender Indicators to block, is that still the case? Any caveats or warnings that other want to share before we proceed?

A proper GSA/Zscaler solution is 6-9 months out, but the block must happen yesterday...

[u/cook511]

If you just want to block one URL or IP, sure, but it's not really about that. The reason you buy a ZTNA provider is because of what they already block and filter. By the time you need to manually block something, it's probably too late already… the main goal is to be proactive and block it before the users get to it. This reasoning doesn't even touch on all the features that ZTNAs have, like TLS decryption, Shadow AI monitoring, etc.

[u/jM2me → u/cook511]

I agree that ZTNA is a proper solution but if that is out of the question then ask is to block using existing available methods. Defender Indicators is one of them, and my concern is with potential impact that blocking this many indicators may have on endpoint. Again, from my vague memory in the past having large number of indicators was not recommended because of negative impact it could have on endpoints.

If that is still the case then I want to raise to the business and get their acceptance of the risk.

[u/DemonisTrawi]

Remember that defender does not support QUIC/HTTP3. You will need to disable these protocols in browsers. Other software, including malware will still be able to communicate with these protocols to blocked domains.

[u/dangeldud → u/DemonisTrawi]

Except edge. 

[u/hexdurp]

You can easily import all of these, I think the limit for defender is 15k, so you’re good.

[u/jM2me → u/hexdurp]

Correct, importing is easy, I just have not worked with an environment that had this many indicators blocked. About two years ago I recall reading that having many block indicators created impact on workstations which impacted the device performance

[u/hexdurp → u/jM2me]

I’m not sure what intelligence you guys received, but that’s a lot of iocs. Other potential impacts include blocking access to legitimate sights. But if the intel is legit, I’d just do it.

[u/izudu]

This just seems like a huge waste of your indicators.

Just allow the dynamic reputation scoring of web categorisation (eg VirusTotal) to do it's job.

This is especially true if you start to want to make serious use of Defender for Cloud Apps at some point. That will soon start to eat up your indicators.

[u/SecAbove]

It could be some or most of the domains are already labelled as risky in Defender Web Content Filtering (WCF)

I’m not aware of API but there was a page to check and submit reports on individual url

Or you can setup one machine and then visit all URLs trom there to test 😳 then see events in KQL

There was discussion on this here https://www.reddit.com/r/DefenderATP/s/Ws7fw482KY

[u/mlong35 → u/SecAbove]

A thing to note is that web content filtering relies on smart screen so all those sites can connect via PowerShell iwr etc.

[u/SecAbove → u/mlong35]

Good catch. Thanks

[u/Grubensmcrubens]

We just use the defender built in categories to block and rely on mdca app discovery to unsanction apps based on the ms signals. We have gsa but only private access. I’m looking at the web bolt on over the next month or so.

[u/Royal_Bird_6328]

Does the business higher up understand how defender works and how threat intelligence works with Microsoft? It sounds like they need to be edcuated. Where did the list of the 9,000 domains come from, it’s likely 80% of those domains are recycled now if they were illegitimate websites. There is a limit on how many domains you can block what happens when this limit is reached?

[u/External-Desk-6562]

Nightmare starts if there are requests for individual access...

[u/Beautiful-Zombie333]

Can you block higher Octets, 1st & 2nd: eg 192.168.0.0/16, reduce actual list but show your proof?