# Network protection is enabled in block mode
Network protection extends Microsoft Defender SmartScreen and Microsoft threat intelligence checks to outbound web traffic from the operating system…
Source: https://maester.dev/docs/tests/ZTA.41053
## Overview
Network protection extends Microsoft Defender SmartScreen and Microsoft threat intelligence checks to outbound web traffic from the operating system, including supported browsers and nonbrowser apps. Microsoft documents that it helps prevent connections to malicious or suspicious sites, such as phishing hosts, malicious downloads, scams, and other poor-reputation sources. This matters because threat actors often use a link, script, Office child process, or loader to reach the next payload or command infrastructure after initial access. If network protection is off or only in audit mode, the connection is logged but not blocked, so execution, credential access, lateral movement, and impact can continue. Network protection does not replace user training, DNS controls, or endpoint investigation, and it depends on Defender Antivirus prerequisites. It adds a device-level block for web-based traffic that may bypass browser-only controls. This check uses the pinned MDATP Secure Score control `scid_96` so the test follows the tenant-level Microsoft signal instead of fragile title matching.
## Remediation
- [Use network protection](https://learn.microsoft.com/en-us/defender-endpoint/network-protection)
- [Turn on network protection](https://learn.microsoft.com/en-us/defender-endpoint/enable-network-protection)
- [Evaluate network protection](https://learn.microsoft.com/en-us/defender-endpoint/evaluate-network-protection)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| ATT&CK | [T1204.001](/docs/tests?mitre=T1204.001) Malicious Link, [T1189](/docs/tests?mitre=T1189) Drive-by Compromise, [T1071](/docs/tests?mitre=T1071) Application Layer Protocol |
| Licence | ATA |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.