Can we block non-PE files (.docx, .xlsx, .pdf) in Defender for Endpoint indicators?

Question

According to Microsoft Defender's documentation, file indicators support Portable Executable (PE) files such as .exe, .dll only.
https://learn.microsoft.com/en-us/defender-endpoint/indicator-file

Does this mean we cannot add/block non-PE files (.docx, .xlsx, .pdf) in Defender for Endpoint indicators?

Thank you.

Answer 1

yep - unfortunately Microsoft Defender for Endpoint file indicators are designed specifically for Portable Executable (PE) files, meaning they cannot be used to block non-executable document formats like .docx, .xlsx, or .pdf. This limitation exists because the feature is intended for binary-level threats, and blocking documents by hash is impractical due to frequent, minor file changes.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin