Block gTLD (.zip)/ FQDN domains with Windows Firewall and Defender for Endpoint
Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad, .phd, .prof, .esq, .foo, .zip, .mov, and .nexus. From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors…
Block C2 communication with Defender for Endpoint
Human-operated ransomware (HumOR) is growing and needs different layers of protection. Microsoft released some new features to protect against C2 communication. Attackers rely heavily on C2 communications for multiple stages, and blocking these direct connections can disrupt or mitigate attacks…
Block “vulnerable/unwanted” applications with Defender for Endpoint and Vulnerability Management
In all environments, reducing the vulnerability surface and getting insights into the vulnerable applications are recommended and important. Microsoft Defender for Endpoint P2 contains the vulnerability management solution for getting visibility based on the installed MDE sensor. Microsoft Defender Vulnerability…
Microsoft Defender SmartScreen – how to use SmartScreen and Phishing protection
Microsoft Defender SmartScreen is available in various Microsoft products and adds an extra/first layer/filter of protection. The core component of Microsoft Defender SmartScreen is protecting against phishing or malware websites/ applications. For Windows 11 more features are available including SmartScreen…
Deploy Microsoft Defender for Endpoint on iOS using Intune/MEM
Microsoft Defender for Endpoint is available for multiple platforms including Windows, macOS, and Linux. For mobile platforms Defender for Endpoint is available for iOS and Android. Multiple methods are available for deploying Defender for Endpoint on iOS devices. This blog…
Microsoft Defender for Endpoint series – Tips and tricks/ common mistakes – Part10
It is time for part 10 of the Microsoft Defender for Endpoint (MDE) series. The final part of the series. Part 10 is focussed on tips and tricks around Defender for Endpoint and some important items scoped on common mistakes…
Microsoft Defender for Endpoint series – Automation via Logic Apps and Sentinel – Part9
It is time for part 9 of the Microsoft Defender for Endpoint (MDE) series. Part 9 is focused on the automation part of Defender for Endpoint with the use of Logic Apps/ Microsoft Sentinel automation. In the previous part, a…
Microsoft Defender for Endpoint series – Advanced hunting and custom detections – Part8
It is time for part 8 of the Microsoft Defender for Endpoint (MDE) series. Part 8 is focused on the hunting experience in Microsoft 365 Defender. The advanced hunting feature and custom detection feature are part of the security.microsoft.com portal….
Microsoft Defender for Endpoint series – integrations with other products – Part7
It is time for part 7 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on Defender for Endpoint and additional configurations. Now it is time for the integration part with other products and services. Microsoft…
Microsoft Defender for Endpoint series – Validate Defender protection and additional troubleshooting – Part6
It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Microsoft Defender Vulnerability Management. Now it is time for the initial testing of the Defender for…
