Forum Discussion
MDE use of Certificate based IoC not working
I have been trying to use MDE IoC with certificates as per the following link: https://learn.microsoft.com/en-us/defender-endpoint/indicator-certificates#create-an-indicator-for-certificates-from-the...
Hello, try to export the certificate with another method. Right-click firefox.exe → Properties → Digital Signatures → select Mozilla signature → Details → View Certificate → Copy to File from the wizard, choose Base64 Ensure it’s the leaf certificate (not a CA) before uploading to MDE for blocking.
Thanks for the suggestion. Unfortunately while testing this with Firefox, Putty and Notepad++ using the cert export process above and adding as indicators - still no blocks happening, either when running the applications or subsequent downloads of the applications using the edge browser (hoping that SmartScreen might do something).
When I add these apps as file hashe indicators, within minutes they are blocked and removed from the machine.