How to Block Malicious .pdf.msi Files in Microsoft Defender
Question details
The user needs to configure Microsoft Defender policies to block files using the .pdf.msi extension to prevent malware infections disguised as PDF documents.
- Product
- Microsoft Defender for Endpoint
- Device & OS
- Windows
- Scenario
- Enhancing organizational security by preventing users from accidentally running malicious installers disguised as standard PDF documents.
- Observed behavior
- Malware authors use the double extension .pdf.msi to trick users into executing a malicious installer instead of opening a document.
Ensure you have administrator access to the Microsoft 365 Defender portal and understand your organization's current endpoint security baseline. It is strongly recommended to test any new security policies in Audit mode before enforcing them to avoid disrupting legitimate business operations.
Use Custom Indicators in Microsoft Defender for Endpoint
Block specific file hashes or certificates associated with known .pdf.msi malware using custom endpoint indicators.
This is the most precise method for blocking known malicious .pdf.msi files without impacting legitimate software installations. Custom indicators allow you to block specific signatures or certificates.
Avoid relying purely on wildcard extension rules (like blocking all files ending in .pdf.msi), as threat actors can easily manipulate file names to bypass these basic rules.
Log in to the Microsoft 365 Defender portal at security.microsoft.com using your administrator credentials.
Go to Settings > Endpoints > Indicators in the navigation pane.
Select the 'File hashes' or 'Certificates' tab, then click 'Add indicator' to input the known signatures of the malicious files.
Set the response action to 'Block and remediate' to ensure the malicious .pdf.msi file is stopped before execution.
Implement Attack Surface Reduction (ASR) Rules
Use ASR rules to block untrusted executable files from running, which prevents malicious MSIs from launching.
Configure Windows Defender Application Control (WDAC)
Use WDAC to explicitly define which applications are allowed to run, effectively neutralizing untrusted .msi files.
Securely Open and Manage Legitimate PDFs with WPS Office
While you secure your endpoints against disguised malware in Microsoft Defender, you need a safe environment for your legitimate documents. WPS Office is a highly secure, free Microsoft Office alternative that safely opens, edits, and manages standard PDF files while offering perfect compatibility with Word, Excel, and PowerPoint formats.
- 1. Download WPS Office: Visit the official WPS Office website to download the secure, verified installation package.
- 2. Install on Windows: Run the trusted setup file to seamlessly deploy WPS Office on your computer.
- 3. Set as Default PDF Reader: Configure WPS Office as your default PDF reader to ensure documents are opened in a safe, dedicated application.
Frequently Asked Questions
Why do malware authors use the .pdf.msi file extension?
By default, Windows may hide known file extensions. A file named 'invoice.pdf.msi' will often appear to the user as simply 'invoice.pdf'. This tricks the user into double-clicking it, which runs the malicious installer (.msi) instead of opening a document.
Can I simply block all files containing '.pdf.' in the name?
While some legacy systems allow wildcard blocking, it is not recommended in modern Microsoft Defender configurations. Threat actors can easily change file names, and relying on wildcards can lead to false positives that block legitimate files. It is better to rely on file hashes, certificate indicators, and Application Control.
Will blocking .msi files prevent normal software updates?
Yes, implementing a blanket block on all .msi files will prevent legitimate software from installing or updating. You should use Attack Surface Reduction (ASR) or Application Control to block only untrusted, unsigned, or unrecognized .msi files.
How do I test a Defender policy without breaking user workflows?
Always configure your Endpoint policies in 'Audit mode' initially. This logs the events where the policy would have triggered a block, allowing you to review the potential impact in the Defender portal before switching the policy to enforce or block mode.
