Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates

Custom indicators let you apply your own threat intelligence in Defender for Endpoint: block a malicious hash, warn on a risky site, or allow a site that web content filtering would block. Each type is enforced by a different component, which is why an indicator sometimes "does nothing". In this post I'll cover the prerequisites, creating and scoping indicators, precedence, and proving a block in advanced hunting.

How it works#

Indicators live in the Microsoft Defender portal under Settings › Endpoints › Indicators (Rules section). Each has a value, an action, an optional expiration and a device group scope. Defender Antivirus enforces file and certificate indicators; SmartScreen enforces IP and URL indicators in Microsoft Edge, and network protection does so in other browsers and processes.

A tenant can hold 15,000 indicators, and Microsoft doesn't raise that limit, so treat indicators as a precise tool, not a bulk blocklist. For blocking whole applications, Microsoft recommends App Control for Business (WDAC) or AppLocker instead of hash indicators, because every version has new hashes.

Prerequisites#

• Tenant switches: in Settings › Endpoints › General › Advanced features, turn on Allow or block file (for file indicators) and Custom network indicators (for IPs and URLs), then save.
• Defender Antivirus in active mode with cloud-based protection and behavior monitoring on. Indicators aren't supported when the antivirus runs in passive mode.
• Platform version: anti-malware client 4.18.1901.x or later for files and certificates, 4.18.1906.x or later for IPs and URLs.
• Network protection in block mode for non-Microsoft browsers and other processes; Edge follows its SmartScreen setting.
• File types: on Windows, file indicators cover portable executables (.exe and .dll) only. On macOS they cover Mach-O executables, shell scripts and AppleScript files (real-time protection on); on Linux, ELF and .sh files from version 101.85.27.
• File hash computation improves blocking accuracy, at some performance cost when copying large files.

A quick check on a Windows device:

Get-MpComputerStatus | Select-Object AMRunningMode, AMProductVersion, BehaviorMonitorEnabled
Get-MpPreference | Select-Object EnableNetworkProtection, MAPSReporting, EnableFileHashComputation
Set-MpPreference -EnableFileHashComputation $true   # test devices only; use Intune or Group Policy for fleets

You want AMRunningMode = Normal, EnableNetworkProtection = 1 (block) and a non-zero MAPSReporting. In Intune, the Defender Antivirus profile settings Enable Network Protection, Allow Cloud Protection and Allow Behavior Monitoring control these; the web content filtering guide walks through that profile.

Step-by-step#

1. Create the indicator#

1. Go to Settings › Endpoints › Indicators and pick the tab: File hashes, IP addresses, URLs/Domains or Certificates.
2. Select Add item (Add indicator on the Certificates tab), enter the value and an expiration date, so temporary blocks don't live forever.
3. Choose the action and description. For block actions, decide whether to generate an alert.
4. Under Scope, select device groups (start with a pilot group), review the summary and save.

You can also add a file indicator from a file's page during an investigation, or import a CSV; use the current template from the bottom of the import panel, because the format changed when the actions were renamed.

2. Write the value correctly#

• Domains: contoso.com also matches every subdomain.
• URL paths: https://contoso.com/block matches only under that path, and HTTPS paths are matched only in Microsoft Edge. HTTP paths work in any browser.
• IP addresses: single external IPv4 addresses, or all eight IPv6 segments. No ranges, CIDR blocks, wildcards or internal addresses.
• Certificates: the leaf signing certificate. Parent and child certificates aren't covered, and Microsoft-signed certificates can't be blocked.

3. Use Warn deliberately#

Warn shows a prompt that users can bypass, with an optional redirect URL to your usage policy. On Windows, the toast only appears if the Files or activities are blocked notification is enabled (FilesBlockedNotificationDisabled = 0 under the Windows Defender Security Center virus and threat protection key).

Precedence: which rule wins#

• IPs, URLs and domains: Allow beats Warn, which beats Block. If two URL indicators conflict, the longer path wins. Indicators created by Defender for Cloud Apps for unsanctioned apps follow the same order, and an allow indicator is the documented way to let one site through a web content filtering block. See shadow IT with Defender for Cloud Apps.
• Files and certificates: an App Control or AppLocker block wins first, then Defender Antivirus exclusions allow the file, then block or warn indicators apply, then SmartScreen, then allow indicators, then ASR rules, controlled folder access and antivirus detections.
• Between file indicators: SHA-256 beats SHA-1, which beats MD5, for the same file, whatever the scope. Otherwise an indicator scoped to the device's group beats one scoped to all devices.
• Certificate versus file: a blocked certificate can't be overridden by a file allow indicator for one of its signed files.
• Email: indicators act on devices. To block URLs and files in mail, use the Tenant Allow/Block List in Defender for Office 365.

Verify#

From a device in scope, open the blocked URL in Edge and in another browser, then run:

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType in ("SmartScreenUrlWarning", "ExploitGuardNetworkProtectionBlocked")
| extend AF = parse_json(AdditionalFields)
| project Timestamp, DeviceName, ActionType, RemoteUrl, InitiatingProcessFileName,
          Category = coalesce(tostring(AF.ResponseCategory), tostring(AF.Experience))

Custom indicator hits show the category CustomBlockList. Don't be misled by a ConnectionSuccess row in DeviceNetworkEvents: network protection decides after the TCP handshake, so that row is logged even when the site was blocked. For files and certificates, Microsoft documents threat names you can search for (a capability it labels as preview):

search in (DeviceEvents, DeviceFileEvents, DeviceProcessEvents) Timestamp > ago(30d)
| where AdditionalFields contains "EUS:Win32/CustomEnterpriseBlock!cl"
     or AdditionalFields contains "EUS:Win32/CustomEnterpriseNoAlertBlock!cl"
     or AdditionalFields contains "EUS:Win32/CustomCertEnterpriseBlock!cl"

Microsoft lists a known limitation for alerts: Block and Warn indicators raise only generic informational alerts (your custom title and severity aren't used), Audit raises alerts with your severity, and Allow raises none. More queries are in advanced hunting for Intune admins.

Tips & gotchas: why an indicator doesn't work#

• Chrome or Firefox ignores a domain block: network protection reads the domain from the TLS handshake, so QUIC and Encrypted Client Hello must be turned off in those browsers (Chrome policies QuicAllowed and EncryptedClientHelloEnabled). Sites loaded through HTTP/2 connection coalescing are only blocked in Edge.
• Nothing happens anywhere: check the tenant switch, the device group, the expiration date and the time to apply first.
• A blocked file still runs: it might not be a PE file, the antivirus might be passive (see passive mode and EDR in block mode), or a Defender Antivirus exclusion covers it, because exclusions win over block indicators. Microsoft-signed files can't be blocked.
• Your settings keep changing: indicators synced from Defender for Cloud Apps are overwritten on each sync, including the alert setting.

References#

• Overview of indicators in Microsoft Defender for Endpoint
• Create indicators for IPs and URLs/domains
• Create indicators for files