Forum Widgets
Latest Discussions
ASR rules enabled after onboarding Windows server
Hello, I tested onboarding Windows Server 2019 to Defender using local script and noticed that after onboarding some ASR rules are already enabled in Block mode by default: Block Office applications from creating executable content 3b576869-a4ec-4529-8536-b80a7769e899 Block execution of potentially obfuscated scripts 5beb7efe-fd9a-4556-801d-275e5ffc04cc Block Office applications from injecting code into other processes 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 Block Win32 API calls from Office macros 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b Block credential stealing from the Windows local security authority subsystem (lsass.exe) 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 Block executable content from email client and webmail be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 Block JavaScript or VBScript from launching downloaded executable content d3e037e1-3eb8-44c8-a917-57927947596d Block all Office applications from creating child processes d4f940ab-401b-4efc-aadc-ad5f3c50688a I haven't applied any group policies yet to it. The server is domain joined. Could it happen that it pulls the configuration from another place? Thanks
Ransomeware query
If any ransomware detection i need following query for advance hunting in defender Look for rapid file modification or creation or deletion 2. Rapid file encryption one 3. look for a ransom note 4. look for encryption algorithms 5. look for double extension 6. Also query for birth time of the fileRegistry modifications
If a file was downloaded, executed, and created a registry entry for persistence, is it enough to just delete the file from its original location? Or does the registry entry also need to be removed? What happens if it is not removed? If a malicious file created an entry under HKLM Run, HKCU Run, or RunOnce, and the file is later deleted but the registry entry is left behind, will the system still try to execute it at startup?
MDE-Onboarding issue
Hello Community, while i am trying to onboard a windows 10 machine into MDE where there is already another AV running which is Kaspersky, i am facing that issue that Microsoft AV is not able to revert its status from disabled into running state (passive mode). even if i am trying to start the service manually, it will revert itself back to the disable status. Did anyone experience that issue before between Defender AV and Kaspersky?
Bad quality of Defender / Intunesdocubannoying
Whenever i need learning.microsoft.com, i found their describing A) very often menulinks, which does not exist (guess its rearranged) B) very often mistakes happen: in this article https://learn.microsoft.com/en-us/defender-endpoint/android-configure-mam several parameters are described with an integer value and the same parameter a Seconds time at the same place as boolean. And so many mistakes morebi found. Well: some companies wanna earn money maybe doing training with their customers, which is necessary onlY, as the docu is unreadable or written so boring that you fall a sleep and understand nothing. Please do more qualityCannot delete a tag added through an Asset rule
Hello, We had created in the past an asset rule to assign a tag to a few machines. Now we are trying to remove the tag but we can't find the right way. We have delete the Asset rule. (it was turned off more than 2 months ago) When I go to the machine details and click on 'Manage tags', I can see a section called 'Manual tags' (there I can add remove tags from the console) and a section called 'Rule-based tags' with the description 'Rule-based tags are automatically added to devices based on rules that you create. You can add, edit or delete a rule in Manage rules.' Going through powershell and the API, it doesn't work either. Even getting the details from a machine only shows the manual tags. How do we remove then such a tag ? Thanks in advance for your help. Marc
how to disable Defender on Windows Server with tamper protection enabled
As a third-party security vendor, when our users enabled tampering protection on Windows Server 2022, we were unable to disable Defender through group policy as before, which resulted in conflicts between third-party anti malware and Defender. Of course, Defender for Endpoint is not onboarded in the system because users do not want to pay for two sets of antivirus software. So in this situation, can only users manually turn off tampering protection? But this is clearly unfriendly for large-scale systems. In addition, installing third-party antivirus software on Windows Server systems that have onboarded Defender for Endpoint seems to have no way to put Defender into passive mode if tampering protection is enabled. We urgently hope that someone can provide some suggestions on this issue!
Azure site recovery cache storage identified with mallware
Hello, I have enable Azure Site recovery on multiple servers. I am using a premium storage account for the cache data required for the replication. Defender is keep being trigger telling that he is detection different Malwares by temporary files that are generated on the cache storage account generated by the replication. The servers, that get replicated, do not detect any mallware on them. What is the reason and what is the solution? Is this a normal behaviour? Thank you
