How does a default deny rule in a firewall prevent unknown attacks?

Preventing users from clicking malicious URIs is the function of web content filtering or DNS security, not a firewall default deny rule.

A default deny rule applies to all traffic directions and types based on the absence of a permit rule, not specifically to outbound packets with unknown payloads.

A default deny (implicit deny) policy means the firewall drops any packet that does not match an explicit allow rule. This stops unknown attacks because no new or unanticipated traffic pattern can pass without a pre-approved rule, effectively making the unknown traffic fall through to the deny action.

Refusing packets that match a defined set of rules describes a blocklist or signature-based deny approach, which is the opposite of default deny - default deny blocks everything NOT explicitly allowed.