'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Block .zip and .mov Top-Level Domains in Microsoft Defender
Question details
The user wants to block network access to the newly introduced .zip and .mov top-level domains using Microsoft Defender without affecting legitimate file downloads that use those exact extensions.
- Product
- Microsoft Defender
- Device & OS
- not provided
- Scenario
- Configuring network security policies to prevent access to potentially malicious .zip and .mov websites.
- Observed behavior
- URL indicators, Safe Links, and firewall rules do not reliably block these entire top-level domains natively without potentially interfering with legitimate file downloads.
Before making changes to your network security policies, ensure you have an isolated testing group. Blocking top-level domains using wildcards can inadvertently disrupt legitimate file downloads, requiring rigorous testing before organization-wide deployment.
Configure Custom Network Indicators with Caution
Use Microsoft Defender's custom URL indicators to target specific domains, but test wildcards thoroughly to ensure normal downloads aren't interrupted.
Microsoft Defender does not currently provide a simple, dedicated control for blocking the .zip and .mov top-level domains globally while exclusively allowing similarly named file downloads. Wildcards must be used but carefully monitored.
Log in to the Microsoft 365 Defender portal using an account with Security Administrator permissions.
In the navigation pane, go to Settings > Endpoints > Indicators.
Select the 'URLs/Domains' tab and click on the 'Add item' button to create a new rule.
Enter the wildcard pattern for the domain (e.g., *.zip or *.mov) and set the execution action to 'Block'.
Apply this new indicator to a restricted test group of devices first to monitor whether legitimate .zip or .mov file downloads are falsely blocked.
Looking for a Secure and Free Office Suite?
While managing complex security policies in the Microsoft ecosystem can be challenging, choosing a secure, lightweight, and highly compatible office suite doesn't have to be. WPS Office provides a safe, seamless alternative to Microsoft Office.
- 1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
- 2. Install the application: Run the installer and follow the simple on-screen instructions to set up WPS Office on your device.
- 3. Open and edit your files: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office documents without formatting loss.
Frequently Asked Questions
Why are .zip and .mov domains considered a security risk?
Threat actors can register .zip and .mov domain names to create malicious phishing websites. Because these domains share the same name as common file extensions, users may click on a link expecting to download a safe file but are instead directed to a harmful website.
Does blocking *.zip in Microsoft Defender block downloading .zip files?
It can. Depending on how the indicators and network proxies process the rules, a wildcard block on *.zip might inadvertently intercept legitimate web requests to download standard .zip archive files. Careful testing is highly recommended.
Can I use Windows Firewall to block these specific top-level domains?
Windows Defender Firewall operates primarily on IP addresses and ports rather than domain names. To block TLDs effectively, you must use a DNS filtering solution, a web proxy, or advanced endpoint protection like Defender for Endpoint's network indicators.
