AiTM/ MFA phishing attacks in combination with “new” Microsoft protections (2024 edition)
Adversary-in-the-middle phishing attacks are still more common in use. Since the removal of basic authentication from Exchange Online more and more attackers are using more modern attacks like adversary-in-the-middle phishing, cookie theft, QR code phishing, and other used attacks. Last…
Onboard Defender for Endpoint without Azure Arc via Direct onboarding
Previously, onboarding hybrid servers to Defender for Servers with MDE required Azure Arc as a pre-requisite for the deployment. Since the standalone plan was removed from the licensing options some time ago (for CSP customers without EA agreement). Azure Arc…
Block gTLD (.zip)/ FQDN domains with Windows Firewall and Defender for Endpoint
Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad, .phd, .prof, .esq, .foo, .zip, .mov, and .nexus. From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors…
Block C2 communication with Defender for Endpoint
Human-operated ransomware (HumOR) is growing and needs different layers of protection. Microsoft released some new features to protect against C2 communication. Attackers rely heavily on C2 communications for multiple stages, and blocking these direct connections can disrupt or mitigate attacks…
Block “vulnerable/unwanted” applications with Defender for Endpoint and Vulnerability Management
In all environments, reducing the vulnerability surface and getting insights into the vulnerable applications are recommended and important. Microsoft Defender for Endpoint P2 contains the vulnerability management solution for getting visibility based on the installed MDE sensor. Microsoft Defender Vulnerability…
Microsoft Defender SmartScreen – how to use SmartScreen and Phishing protection
Microsoft Defender SmartScreen is available in various Microsoft products and adds an extra/first layer/filter of protection. The core component of Microsoft Defender SmartScreen is protecting against phishing or malware websites/ applications. For Windows 11 more features are available including SmartScreen…
Deploy Microsoft Defender for Endpoint on iOS using Intune/MEM
Microsoft Defender for Endpoint is available for multiple platforms including Windows, macOS, and Linux. For mobile platforms Defender for Endpoint is available for iOS and Android. Multiple methods are available for deploying Defender for Endpoint on iOS devices. This blog…
Microsoft Defender for Endpoint series – Tips and tricks/ common mistakes – Part10
It is time for part 10 of the Microsoft Defender for Endpoint (MDE) series. The final part of the series. Part 10 is focussed on tips and tricks around Defender for Endpoint and some important items scoped on common mistakes…
Microsoft Defender for Endpoint series – Automation via Logic Apps and Sentinel – Part9
It is time for part 9 of the Microsoft Defender for Endpoint (MDE) series. Part 9 is focused on the automation part of Defender for Endpoint with the use of Logic Apps/ Microsoft Sentinel automation. In the previous part, a…
Microsoft Defender for Endpoint series – Advanced hunting and custom detections – Part8
It is time for part 8 of the Microsoft Defender for Endpoint (MDE) series. Part 8 is focused on the hunting experience in Microsoft 365 Defender. The advanced hunting feature and custom detection feature are part of the security.microsoft.com portal….
