Blog Post

Microsoft Defender Blog
1 MIN READ

How behavioral blocking & containment stops post-exploitation tools like BloodHound, Kerberoasting

Eric Avena's avatar
Eric Avena
Icon for Microsoft rankMicrosoft
Aug 28, 2020
Behavioral blocking and containment capabilities in Microsoft Defender Advanced Threat Protection (ATP) use protection engines that specialize in detecting and stopping threats by analyzing behavior....
Updated Aug 28, 2020
Version 4.0
Endpoint Security
MichaelG666's avatar
MichaelG666
Brass Contributor
Nov 10, 2022

The following script https://gist.github.com/Hestat/59b86df6ced15021eb3080338959969d when run as a regular user disables AMSI completely and any malicious PowerShell commands that are subsequently run in the same PowerShell ISE session are no longer blocked by Defender and are allowed to run. Any idea how to fix this, Eric Avena ?

Thanks a lot.