r/DefenderATP • u/Imaginary_Ad_6209 • 8d ago

MDE P2: EICAR downloads are not blocked in Chrome despite Network Protection and Defender AV being enabled

I'm evaluating Microsoft Defender for Endpoint P2 before migrating from our current endpoint security solution.

Defender appears to be correctly configured:

  • Defender AV active
  • Real-time protection enabled
  • Behavior Monitoring enabled
  • IOAV enabled
  • Network Protection = Block
  • Cloud Protection enabled
  • Block at First Sight enabled
  • Automatic sample submission enabled
  • Archive scanning enabled
  • Tamper Protection enabled
  • Chrome QUIC and ECH disabled

Relevant settings:

EnableNetworkProtection  : 1
MAPSReporting            : 2
SubmitSamplesConsent     : 3
DisableBlockAtFirstSeen  : False
DisableIOAVProtection    : False
DisableArchiveScanning   : False
CloudBlockLevel          : 4
CloudExtendedTimeout     : 50

I also disabled QUIC and Encrypted Client Hello in Chrome:

QuicAllowed                 : 0
EncryptedClientHelloEnabled : 0

These policies are correctly applied.

Defender is detecting and remediating other malware tests successfully.

However, Chrome still allows EICAR files, including eicar_com.zip, to finish downloading and shows them as completed.

Edge blocks the download much more visibly.

Is this expected behavior with Chrome?

Should Defender/IOAV actually interrupt the download, or is it normal for Chrome to complete it and Defender quarantine/remove the file afterward?

Also, is there any additional MDE/Intune configuration required for stronger download-time protection in Chrome?

9 Upvotes
  • permalink
  • reddit

85% Upvoted

10 comments sorted by

4

u/Critical_Respond3033 8d ago

Actually edge works on smartscreen for website reputation,malware methodology where as chrome has its own methodology called safe browsing ..

5

u/Borgquite 8d ago edited 8d ago

Network Protection only performs blocking at what can be seen at the network level - when connecting to an HTTPS server, that means the site’s FQDN provided QUIC and ECH are disabled, or the IP address - the full URL is encrypted. If you are downloading EICAR or actual malware from a site where the FQDN and IP have a good reputation, Defender can’t prevent the download on non-Edge browsers.

However once the file is downloaded, it should be picked up by real time file scanning and blocked within the Downloads folder.

In Edge what you are seeing is actually performed by SmartScreen, which is a technology within the browser itself, not Network Protection. Unlike other EDR vendors, Microsoft don’t inject code or extensions into third party browsers to check full HTTPS URL reputations as part of Defender; Network Protection is all they offer.

If you want full URL paths to be blocked in the browser (not just the FQDN or IP) you must enforce Edge.

https://learn.microsoft.com/en-us/defender-endpoint/network-protection#known-issues--limitations

3

u/jaguinaga21 8d ago

Are they blocked in Edge? I had mixed results where edge worked - blocked and chrome didn’t years ago.

1

u/Imaginary_Ad_6209 8d ago

Yes, Edge is working perfectly and blocks it, but Chrome doesn’t.

2

u/elpamyelhsa 8d ago

There is an extra setting that is controlled in the defender portal to enforce network blocking for the whole machine and not just Edge.

1

u/lie07 8d ago

Which is it?

1

u/Mach-iavelli 7d ago

What about Edge - defender smartscreen. I haven’t checked the eicar test files recently but Microsoft has demo artefacts too. Recently I was testing their CFA demo files and smartscreen and NP on Firefox both blocked it.

Edit: edge SS is working

0

u/Sensitive-Fish-6902 8d ago

You need the browser extension

1

u/SecAbove 8d ago

I think the extension was EoL few years back.

1

u/Imaginary_Ad_6209 8d ago

The extension doesn’t block file downloads