Skip to content

defender-endpoint-demonstration-smartscreen-url-reputation.md

Latest commit

 

History

History
101 lines (61 loc) · 3.73 KB

defender-endpoint-demonstration-smartscreen-url-reputation.md

File metadata and controls

101 lines (61 loc) · 3.73 KB

title: Microsoft Defender for Endpoint SmartScreen URL reputation demonstrations description: Demonstrates how Microsoft Defender SmartScreen identifies phishing and malware websites based on URL reputation. search.appverid: met150 ms.service: defender-endpoint ms.author: lwainstein author: limwainstein ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:

  • m365-security
  • tier2
  • demo ms.topic: article ms.subservice: asr ms.date: 03/04/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft Defender for Business

URL reputation demonstrations

Test how Microsoft Defender SmartScreen helps you identify phishing and malware websites based on URL reputation.

Prerequisites

  • Client devices must be running Windows 11 or Windows 10
  • Server devices must be running Windows Server 2008 R2 SP1, Windows Server 2012 R2 and later, or Azure Stack HCI OS, version 23H2 and later.
  • Microsoft Edge browser required
  • For more information, see Microsoft Defender SmartScreen

SmartScreen for Microsoft Edge URL scenario demonstrations

Is This Phishing?

Alerts the user to a suspicious page and ask for feedback:

  • Is this Phishing?

    Launching this link should render a message similar to the following screenshot:

    :::image type="content" source="media/smartscreen-url-reputation-is-this-phishing.png" alt-text="SmartScreen alerts the user the site is potentially a phishing site and possibly unsafe":::

Phishing Page

A page known for phishing that should be blocked:

  • A known Phishing page

    Launching this link should render a message similar to the following example:

    :::image type="content" source="media/smartscreen-url-reputation-this-is-phishing.png" alt-text="SmartScreen reports the site is known for containing phishing threats":::

Malware page

A page that hosts malware and should be blocked:

  • A known malware page

    Launching this link should render a message similar to the following screenshot:

    :::image type="content" source="media/smartscreen-url-reputation-malware-page.png" alt-text="SmartScreen alerts the user that the site is know for containing harmful programs":::

Blocked download

Blocked from downloading because of its URL reputation

Exploit page

A page that attacks a browser vulnerability

Malvertising

A benign page hosting a malicious advertisement

  • A page known to contain malicious advertisements

    Launching this link should render a message similar to the following screenshot:

    :::image type="content" source="media/smartscreen-url-reputation-malvertising.png" alt-text="A demonstration of how SmartScreen responds to a frame on a page that is detected to be malicious. Only the malicious frame is blocked":::

See also

Microsoft Defender SmartScreen Documentation

Microsoft Defender for Endpoint - demonstration scenarios