Network protection is enabled in block mode

Overview

Network protection extends Microsoft Defender SmartScreen and Microsoft threat intelligence checks to outbound web traffic from the operating system, including supported browsers and nonbrowser apps. Microsoft documents that it helps prevent connections to malicious or suspicious sites, such as phishing hosts, malicious downloads, scams, and other poor-reputation sources. This matters because threat actors often use a link, script, Office child process, or loader to reach the next payload or command infrastructure after initial access. If network protection is off or only in audit mode, the connection is logged but not blocked, so execution, credential access, lateral movement, and impact can continue. Network protection does not replace user training, DNS controls, or endpoint investigation, and it depends on Defender Antivirus prerequisites. It adds a device-level block for web-based traffic that may bypass browser-only controls. This check uses the pinned MDATP Secure Score control scid_96 so the test follows the tenant-level Microsoft signal instead of fragile title matching.

Remediation

• Use network protection
• Turn on network protection
• Evaluate network protection

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1204.001 Malicious Link, T1189 Drive-by Compromise, T1071 Application Layer Protocol
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.