Academy
TermDefence

URL filtering

Restricting the web addresses users can reach by category, reputation or list.

Flow

  1. 1The address is evaluated
  2. 2Policy is applied
Related families
—
MITRE ATT&CK
T1189 · Drive-by Compromise
Sources
3 sources
01

Overview

MITRE lists restricting web-based content as a separate mitigation: blocking access to known malicious sites, ad networks and unnecessary file types. MITRE ATT&CK

A significant part of infostealer distribution arrives via the web; if the fake download page or fake verification page is blocked before it opens, the chain never starts. CISA and FBI (AA25-141B)

02

How it works

  1. 1

    The address is evaluated

    Category, reputation and registration age are checked. MITRE ATT&CK

  2. 2

    Policy is applied

    It is allowed, warned about or blocked. MITRE ATT&CK

03

How to detect it

  • Correlate blocked access attempts with the same user and device. MITRE ATT&CK
04

What to do

  • Restrict access to newly registered and uncategorised domains. MITRE ATT&CK
05

MITRE ATT&CK

T1189Drive-by Compromise
06

Related terms

Terms

MalvertisingNext-generation firewallGateway security
07

Sources

  1. 1Drive-by Compromise (T1189) · MITRE ATT&CK
  2. 2Restrict Web-Based Content (M1021) · MITRE ATT&CK
  3. 3Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21