Whitelisting Pentesting tools

Please check one of the following steps; it might help resolve the issue.

1. Tag the Machine as "Pentest"

• In Microsoft Defender Security Center, go to Settings > Device Groups.
• Create a new device group and tag the machine used for pentesting.
• Use this tag in advanced hunting queries and exclusions.

1. Create Automated Investigation & Response (AIR) Exclusions

• Go to Microsoft Defender Security Center.
• Navigate to Settings > Endpoints > Indicators.
• Add exclusions based on:
• IP addresses (the pentest tool's machine).
• User accounts (the accounts used for testing).
• Process paths (the executable files used).

1. Custom Detection Rules to Auto-Resolve Alerts

• Use Advanced Hunting to identify recurring alerts triggered by the pentesting tool.
• Go to Microsoft 365 Defender > Hunting > Advanced Hunting.
• Write a KQL query to match known pentesting activities.
• Create an Automated Investigation Rule that sets alerts to resolved.

1. Disable Defender's Automatic Blocking for the Pentest Machine

• If your tool is being blocked, add an exception for the pentest machine in Defender settings.
• Go to Settings > Endpoints > Attack Surface Reduction Rules.

• • Add exclusions for the specific actions being flagged.