How to block *.pdf.msi in Microsoft Defender

Rubida, Kody 0 Reputation points
2024-02-02T20:45:10.25+00:00

I was reading through security news and came across this article https://www.bleepingcomputer.com/news/security/microsoft-teams-phishing-pushes-darkgate-malware-via-group-chats/  There is a known file type of .pdf.msi that we as a company are wanting to block. We would want to add a wildcard in front of that extension to block anything under that file name. Can someone help me as to how I would do this in Defender?

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Catherine Kyalo 655 Reputation points Microsoft Employee
    2024-02-15T13:25:20.7266667+00:00

    Hi @Rubida, Kody Unfortunately, Microsoft Defender doesn't currently support blocking by file extension or wildcard. Custom indicators work with hashes (SHA-1, SHA-256, or MD5). You can use PowerShell to get the file hash

    Get-FileHash C:\path\to\file.iso

    Then Navigate to https://security.microsoft.com/ > Settings > Endpoints > Indicators and set it up as an Indicator. Here is a link https://video2.skills-academy.com/en-us/microsoft-365/security/defender-endpoint/manage-indicators?view=o365-worldwide

    0 comments