Microsoft Defender for Endpoint Blog articles

Introducing effective settings: See security configurations enforced on your device

ArielMichaeli1 — Mon, 09 Mar 2026 16:00:00 GMT

See exactly which security configurations are enforced on your device

Security teams spend significant time defining policies for Microsoft Defender security settings. But when it comes to investigations or troubleshooting, the real question is often simple: what is currently being enforced on this device? Today, we’re excited to share that the settings experience is now generally available in Defender to provide this critical visibility.

Figure #1: Effective settings tab on the device page

From intended policy to real-world enforcement

Understanding device security posture sometimes means correlating policy intent across multiple management sources, including Intune, Group Policy Object (GPO), and local admin configurations. With effective settings, administrators can see the effective value of each security setting on a specific device—along with the configuration source—and quickly identify configuration attempts that didn’t take effect. This helps eliminate silent gaps where intended protections are not actually enforced, reducing the risk of unnoticed exposure during incidents or active attacks. And this shift from intent to reality helps teams move faster when validating posture, investigating incidents, or resolving conflicts between management tools.

A new view on the device page

The effective settings tab is available as a new tab under the configuration management tab on the device page. From this single location, you can:

View the actual value enforced for each security setting
Identify the configuring source responsible for that value
See additional configuration attempts from other sources that were evaluated but not applied

For complex or layered scenarios such as Microsoft Defender Antivirus exclusions and Attack Surface Reduction (ASR) rules, all configured rules are shown together with their effective value, configuring source, and additional configuration attempts.

This makes it far simpler to understand why a device behaves the way it does, without jumping between consoles or guessing which policy “won.”

Figure #2: Simple settings side panelFigure #3: Complex settings side panel

Practical use cases

Security admins and analysts can use effective settings for use cases like:

Validating enforcement – Confirm that intended security configurations are truly applied on devices
Troubleshooting conflicts – Quickly spot competing policies or management sources that prevented a configuration from being enforced
Improving operational confidence – Reduce uncertainty by relying on an authoritative, device-level view of security settings

Platform support and what’s next

The current release focuses on Windows platform antivirus security settings, including ASR rules and exclusions. This is just the beginning. Our roadmap includes expanding coverage across additional platforms, and a broader set of security settings configured through the Microsoft 365 Defender and Intune portals.

Getting started

If you’re using Microsoft Defender for Endpoint, head to a device page and open the configuration management → effective settings tab to explore the experience firsthand.

Supported versions:

Microsoft Defender for Endpoint Sense client: 10.8735.26018.1000 or later
Microsoft Defender Antivirus platform: 4.18.25010.11 (January 2025 release) or later

Learn more

Learn more about investigating devices in Defender. To get started, navigate to a device page and open the configuration management → effective settings tab.
To learn more about Microsoft Defender endpoint protection, check out our website.
To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Transparent and customizable onboarding for modern and legacy Windows devices

Sinclaire_Hamilton — Tue, 03 Mar 2026 03:25:40 GMT

Onboarding all devices in your estate is paramount for strong security posture. In fact, Microsoft Threat Intelligence research shows that in the majority of ransomware attacks, the spreader machine was a device that was not yet onboarded. But customers often struggle to follow complex steps that differ by OS, accidentally duplicate devices because they can’t tell whether onboarding is in progress or failed, or have incorrect initial configuration settings causing system incompatibility. That’s why we’re introducing an updated onboarding experience via the Defender deployment tool for Windows that improves progress visibility and adds controls—like package naming and configurable expiry—to help administrators manage onboarding securely at scale.

What’s new

The Defender deployment tool streamlines the onboarding process by dynamically adapting to the operating system, delivering healthy endpoint security to a diverse estate of Windows devices. It is the preferred automated solution that works on modern and legacy devices and removes the need for a separate onboarding file by embedding the onboarding package and all related information within a downloadable .exe that can be run to onboard devices. This updated experience makes onboarding more predictable and transparent, while adding administrative controls that help reduce exposure if onboarding packages are accidentally shared beyond your organization:

A single, runnable .exe for onboarding with the onboarding information embedded (no separate onboarding file required)

Silent and non-interactive onboarding options to support large-scale deployments with tools like Group Policy or Configuration Manager

Custom package identifiers to help track and manage onboarding packages across your organization

Configurable onboarding package expiry (up to one year)

Customizable name identifiers and keys for increased control and visibility

New portal entry points and guidance to make it easier to find the right onboarding and offboarding method for Windows, including directly from the device inventory page

The new, streamlined onboarding tab in the Defender portal

Customize your deployment package

This experience moves away from using scripts and loose blobs, making it more difficult for onboarding to take place at the hands of unauthorized users and significantly decreasing security issues related to blobs in the wild that don't expire. And for the first time, you can set custom expiry dates on onboarding packages for 1 day, 7 days, or a custom amount up to a year. Expiry for onboarding packages protects customers from unwanted onboarding and compliance issues, limiting packages from getting misused if they’re found in a public place. Expiry reduces the likelihood of unauthorized package usage, together with the new portal-provided key that you must input to complete the onboarding process.

Customize your deployment package with a name and expiry date

See your onboarding telemetry in detail

Deployment tool events are available in the device timeline and advanced hunting tabs for increased transparency into onboarding progress and errors, so you can quickly address any issues.

On the new deployment packages page, you can see your organization's onboarding packages at a glance and click to see more package properties, increasing visibility and traceability within the onboarding process. This is a great foundation for adding even more onboarding-related telemetry to view per device in the future. You can even filter by active or expired packages and hide packages you no longer wish to see.

The new deployment packages page in the Defender portal

To experience this next iteration of the Defender deployment tool for Windows, navigate to Settings > Endpoints > Onboarding > Windows, or jump there directly from the device inventory page. There you'll see the newly designed onboarding page in the Defender portal, complete with on/offboarding guides. Select the Defender deployment tool from the options shown.

New onboarding and offboarding buttons on the device inventory page

The Defender deployment tool is also available for Linux. We look forward continuing to share ways we're making it easier to onboard devices to Defender.

Learn more

Deploy Microsoft Defender endpoint security to Windows devices using the Defender deployment tool (preview) - Microsoft Defender for Endpoint | Microsoft Learn

Deploy Microsoft Defender endpoint security to Linux devices using the Defender deployment tool (preview) - Microsoft Defender for Endpoint | Microsoft Learn

To learn more about Microsoft Defender's endpoint protection, check out our website.

To learn more about Microsoft Security solutions, visit our website. Bookmark the https://www.microsoft.com/security/blog/ to keep up with our expert coverage on security matters. Follow us on LinkedIn (https://www.linkedin.com/showcase/microsoft-security/) and X (https://twitter.com/@MSFTSecurity) for the latest news and updates on cybersecurity.

Introducing library management in Microsoft Defender

amibarayev — Tue, 17 Feb 2026 17:52:18 GMT

In dynamic investigation environments, preparation and agility are key. Security analysts working with live response in Microsoft Defender often rely on scripts and tools to triage, investigate, and remediate threats. Until now, these assets had to be uploaded during active sessions, limiting manageability and increasing time to action.

Recognizing the need for better readiness and control, Defender now introduces a more proactive and efficient way to manage these assets: library management.

The new library management experience in Defender brings powerful enhancements to how security teams manage scripts and files used in live response. With this centralized and streamlined interface, analysts no longer need to wait for an active session to organize their investigation tools everything can now be managed proactively, directly from the portal. This enhancement in Defender’s live response tooling improves operational readiness, enhances visibility and control, and helps streamline response workflows across SOC teams.

What’s new in library management?

Centralized script and file management – Security teams can now upload, manage, and clean up their entire collection of Live Response scripts and files outside of an active investigation. This proactive approach allows better preparation and alignment across analysts.

Upload in advance – Easily upload PowerShell scripts, batch files, or other response tools ahead of time, so they're immediately accessible when needed during an investigation.

View script contents in the portal – No need to switch tools, analysts can review script contents directly within the Defender UI to validate logic and confirm functionality before execution.

Clean and organize – Outdated or redundant scripts can be deleted with a click, keeping your library lean, relevant, and audit-friendly.

Boost analyst understanding with Copilot – Understanding unfamiliar scripts can slow down investigations. That’s where Microsoft Security Copilot comes in.

Copilot automatically analyzes scripts in the library and provides:

Summarized behavior descriptions
Security-relevant insights
Execution risk context

This makes it easier for analysts—especially those new to a team or handling inherited tools—to assess what a script does before running it, reducing errors and increasing confidence.

Get started today

You can access the Library Management experience from the live response page in the Microsoft Defender portal. Start uploading your investigation tools, explore script previews, and let Copilot assist in surfacing the intent and behavior of your scripts.

Ignite 2025: Microsoft Defender now prevents threats on endpoints during an attack

clairelevy — Thu, 20 Nov 2025 21:50:11 GMT

This year at Microsoft Ignite, Microsoft Defender is announcing exciting innovations for endpoint protection that help security teams deploy faster, gain more visibility, and proactively block attackers during active attacks:

Predictive shielding: Defender is the first security solution to not only respond instantly during an attack but also jump ahead of attackers, predicting and preventing the next move before it happens with just-in-time hardening controls that block specific attacker techniques to protect critical assets.
Custom data collection: Defender is now the only endpoint protection solution that allows data-hungry security teams to meet specific telemetry needs by optimizing their data collection right within the Defender portal, without the need to rely on fragmented and siloed solutions.
Expanded Defender support for legacy Windows devices: Better protect vulnerable legacy devices with consistent OS support of Microsoft Defender capabilities across Windows 7 & Windows 2008 R2 and higher.
Defender deployment tool: Streamline the onboarding process with a lightweight tool that dynamically adapts to the operating system, delivering healthy endpoint security to a diverse estate of Windows and Linux devices.

Video: Check out what's new in endpoint protection with Defender

Jump ahead of attackers: autonomous defense, real results

Automatic attack disruption is a capability unique to Microsoft Defender that contains attacks wherever they appear in your environment. It automatically detects and disrupts in-progress attacks with over 99% confidence, disrupting ransomware in an average of 3 minutes. In recent months, it disabled nearly half a million compromised accounts while saving over 270,000 devices.

But today’s landscape is relentless: over 80% of advanced attacks are multi-stage and persistent, forcing defenders to be perfect over and over again. Even in the face of this incessant threat, the industry-wide approach of reactively responding to attacks is accepted as the best we can do. Until now.

Today we are thrilled to move the bounds of endpoint protection by introducing predictive shielding, a groundbreaking, proactive capability of attack disruption.

It acts in two steps:

1. As soon as a compromised asset is contained, Defender predicts the attack paths and tactics the adversary will use next, in many cases narrowing down tens of thousands of possible pathways to just a few with the highest likelihood.

Image 1: Defender predicts the path and tactics an attacker will use

2. Then, it jumps ahead of the attacker and shields those pathways by using just-in-time hardening methods, giving the attacker nowhere to go.

Image 2: Defender shields the path with just-in-time hardening tactics

So how can Defender do this when no one else can? It comes down to a combination of our unique visibility, leading threat intelligence, and AI-powered innovation. Defender uses AI technology to analyze the attack as it’s happening, identifying patterns of known attackers based on Microsoft’s deep threat intelligence, and then applies that to our unique understanding of the organization’s environment based on graph insights and integration as part of the Microsoft platform. With all this context, Defender can identify common attack techniques, which assets they’re trying to get to, and how they’ll try to get there.

Based on these insights, Defender deploys innovative hardening capabilities that block specific attacker tactics and turn on as the attack is underway, just before an attacker attempts to use those tactics. Today we are starting with hardening capabilities seen in sophisticated ransomware campaigns, including group policy objects (GPO), safe mode reboot for tampering, and domain account compromise.

While the precision of predictive shielding allows us to block operations surgically, security teams remain in command, with full visibility and control. All collected data and predictive shielding actions are available for investigation in the Defender portal, with controls that allow security teams to turn off hardening tactics with one click.

Image 3: The Defender portal provides full visibility into predictive shielding actions, with the option to turn them off

Ready to see the future of autonomous defense? Join us online or in person for our Microsoft Ignite session on November 20^th.

See the data you want to see, right in Defender

Security teams today are data savvy and are always looking for full visibility into their telemetry. Defender has long provided over 200 types of raw event types, each enriched with numerous properties and accessible through the threat hunting experience in the Defender portal. But each organization has unique data requirements, so many security teams use complex add-on products to collect and analyze additional data, contributing to the already overwhelming number of solutions they’re using.

That’s why today we’re announcing the ability to collect and hunt across custom data right within the Defender portal. You can now easily build custom data collection rules based on your organization’s specific needs using natural language; no PhD required! We are releasing several new data types that can be collected, for example the highly requested AMSI for hunting over script content, and Kerberos for hunting auth-based and network attacks.

Image 4: Easily create custom data collection rules in the Defender portal

This truly integrated custom data offering is possible thanks to Microsoft’s platform approach, as the additional telemetry can be collected and analyzed via Defender and stored via Microsoft Sentinel. This expansion puts you in complete control of any customized, add-on data, including exactly which data types are collected and how long they are stored. No other security solution has fully integrated and customizable telemetry collection and analysis.

Expanded support for Windows 7 and 2008 R2

Upgrading to the latest versions of each operating system as soon as possible is critical to optimize your security, but we understand that this is simply not realistic for many organizations. Our data shows that more than 90% of enterprises continue to have at least some legacy devices in their environment. Attackers know they present gaps in even the tightest security posture.

That’s why today we are improving Defender’s coverage with expanded support for Windows 7 and Windows 2008 R2 to help you keep your legacy systems protected. We know that many organizations have Windows 7 and 2008 R2 in their environments, and it’s a critical milestone for us to support customers in bringing a consistent endpoint protection capability set across OS versions with Microsoft Defender.

Image 5: Operating system coverage with Microsoft Defender

This new release further expands Defender support to the broad set of Windows, macOS, iOs, Android, and Linux versions listed in image 5. We’re committed to meeting you where you are to help you protect the most vulnerable points in your environment, so we are always evaluating demand and will continue to expand our coverage moving forward.

Simplified deployment for Windows and Linux

Organizations are faced with the challenge of securing diverse device fleets spanning multiple operating systems, hardware configurations, and user scenarios. Historically, the more diverse your operating system estate, the more complex your onboarding process, because it often requires a combination of endpoint management solutions like Microsoft Intune, but also scripts, downloads, and multiple manual installations to ensure coverage.

To help security teams onboard simply and securely, we’ve built new Defender deployment tools for Windows and Linux, which handle the entire process for you. Just download a single package and it will dynamically adapt to the operating system, take care of prerequisites, and install the latest version of Defender available as needed for older devices that don’t have it already built in. The Defender deployment tools eliminate friction, automate tricky steps, and provide predictability throughout the onboarding journey.

They also have several controls built in that allow you to test for issues before onboarding and can accommodate complex scenarios like virtual desktop infrastructure. For customers of Microsoft Intune and Microsoft Defender for Cloud, the Defender deployment tools work in tandem, available to use for legacy systems or complex scenarios.

This release is the latest step in our journey to secure diverse device environments and sets the foundation for a unified and intuitive deployment experience—one that meets the demands of modern IT and security teams across organizations of all sizes.

We hope you’ll join us online or in San Francisco for our Microsoft Ignite session on November 20^th to learn more about these and other exciting announcements in Defender’s industry-leading endpoint protection.

Featured sessions:

BRK240: Endpoint security in the AI era: What's new in Defender; November 20^th 9:45am PT
THR747: Disrupt ransomware attacks before harm occurs with Microsoft Defender; November 21^st 9:30am PT
BRK241: Microsoft Defender: Building the agentic SOC with guest Allie Mellen; November 19^th 9:00am PT
BRK246: Blueprint for building the SOC of the future; November 19^th 4:00pm PT

Related resources:

To learn more about Defender’s endpoint protection, visit our website. Bookmark our blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

End of Windows 10 Support: What Defender Customers Need to Know

clairelevy — Tue, 14 Oct 2025 16:26:01 GMT

As of today, October 14, 2025, Microsoft is officially ending support for Windows 10. This means that Windows 10 devices will no longer receive security or feature updates, nor technical support from Microsoft. While these devices will continue to operate, the lack of regular security updates increases vulnerability to cyber threats, including malware and viruses. Applications running on Windows 10 may also lose support as the platform stops receiving updates.

Will Defender continue to protect Windows 10 devices?

Defender supports a range of legacy systems, including Windows 10. (See here for a full list of supported operating systems.) Microsoft Defender will continue to provide detection and protection capabilities to the extent possible on Windows 10 and other legacy systems. Keep in mind that security solutions on legacy systems are inherently less secure and may not be able to receive all new features, so please review the next section for important actions you can take.
For Windows 10 customers without Defender, Microsoft will continue to provide security intelligence updates for the built-in Microsoft Defender Antivirus protection through October 2028. Of course, Defender Antivirus alone isn't a comprehensive risk mitigation posture without Microsoft Defender detection and response deployed across your digital estate.

What should customers do to protect their Windows 10 devices?

Upgrade to Windows 11:
Moving to Windows 11 is strongly recommended for PCs eligible to upgrade. Windows 11 delivers the latest security features, improved performance, and ongoing support at no additional cost. This is the best way to ensure your endpoints remain protected and compliant. Devices running Windows 10 will be more vulnerable, even with ongoing security intelligence updates (SIUs).
Extended security update (ESU) program:
If upgrading isn’t immediately possible, Microsoft offers an ESU program for Windows 10. The ESU program provides critical and important security updates but does not include new Windows features or technical support.
- Enterprise customers can purchase ESU for up to three years or receive it at no additional cost with a Windows 365 subscription.
- Cloud and virtual environments: Windows 10 devices accessing Windows 11 Cloud PCs via Windows 365 or Virtual Machines are entitled to ESU at no extra cost, with automatic updates.
- Consumer customers have options to enroll for one year of ESU, including free enrollment methods in certain regions.

For further guidance, check out the posts below or connect with your Microsoft account team.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Multi-tenant endpoint security policies distribution is now in Public Preview

tomasbeerthuis — Thu, 07 Aug 2025 16:17:41 GMT

We’re excited to announce a key milestone in Defender’s multi-tenant management journey—Microsoft Defender for Endpoint security policies can now be distributed across multiple tenants from the Defender multi-tenant portal. This capability empowers security teams to manage policies at scale, ensuring consistency and saving valuable time.

What is content distribution?

Content distribution is a powerful Defender feature that enables scalable management of content across tenants. With this capability, you can create content distribution profiles in the multi-tenant portal that allow you to seamlessly replicate existing content—such as custom detection rules and now, endpoint security policies—from a source tenant to designated target tenants. Once distributed, the content runs on the target tenant, enabling centralized control with localized execution.

How it works

- Security policies are now a selectable content type when creating a distribution profile.
- Simply choose existing policies from your home tenant and add them to the distribution profile. You can also decide which Microsoft Entra group(s) will be applied as scope. Policy targeting will be based on the Entra device groups that exist in every tenant, and you select the relevant groups for each tenant.
- Upon completion, policies are automatically distributed to the selected tenants and are applied on the targeted machines.

Distributed policies also appear in a hierarchical view, with the original policy serving as the parent. You can find the policies that were distributed from the tenant under the original policy. This appears on the endpoint security policies page within multi-tenant management.

The last distribution status for the original policy reflects the overall status of its distributed copies, and the tenants and tenant groups sections indicate the recipients of the policy.

At any time, you can update the policies, tenants, scope or any other settings, and sync to apply these changes.

This new capability enables consistency (maintaining uniform security posture across tenants), efficiency (eliminating manual duplication and reducing operational overhead), and scalability (easily expanding coverage as the tenant landscape grows).

FAQ

What pre-requisites are required?

Access to more than one tenant with Microsoft Defender for Endpoint, with delegated access via Azure B2B or GDAP (CSP Partners only), using the multi-tenant management capability.
A subscription to Microsoft 365 E5 or Office E5.

What permissions are needed to distribute MDE security policies?

To access endpoint security policies, users require the security administrator role in each relevant tenant.
To distribute content using multi-tenant management content distribution, the Security settings (manage) or Security Data Basic (read) permission is required. Both roles are assigned to the Security Administrator and Security Reader Microsoft Entra built-in roles by default.

Can I update or expand distribution profiles later?

Yes. You can add more content, include additional tenants, or modify scopes as needed.

Learn more

For more information, see Content distribution in multitenant management. To get started, navigate to the Content distribution page.
To learn more about Microsoft Defender's endpoint protection, check out our website and video.
To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Maintain connectivity for essential services with selective network isolation

amibarayev — Wed, 25 Jun 2025 16:29:44 GMT

Network isolation refers to how Microsoft Defender for Endpoint restricts a compromised device’s communication within the network in order to contain threats and prevent lateral movement. But oftentimes when isolating devices, certain critical services like management tools or security solutions need to remain operational.

That's why Defender for Endpoint has launched selective isolation exclusions, which allow you to exclude specific devices, processes, IP addresses, or services from unilateral network isolation actions. This allows essential functions (e.g., remote remediation or monitoring) to continue in the event of a breach, while limiting broader network exposure.

Isolation Modes

There are two modes available:

Full isolation:
- In this mode, the device is completely isolated from the network, and no exceptions are allowed. All traffic is blocked, except for essential communications with the Defender agent.
- Exclusions cannot be applied in full isolation mode. This is the most secure option, suitable for scenarios where a high level of containment is necessary.

[New] Selective isolation:
- Selective isolation allows administrators to apply exclusions to ensure that critical tools and network communications can still function, even while maintaining the device’s isolated state.
- ⚠️ Note: Any exclusion weakens device isolation and increases security risks. To minimize risk, configure exclusions only when absolutely necessary. Regularly review and update exclusions to align with security policies.

To get started, read the isolation exclusions documentation.

Learn more

Microsoft’s participation in MITRE ATT&CK® Evaluations: Enterprise 2025

KarthikSelvaraj — Fri, 13 Jun 2025 19:00:00 GMT

Microsoft has a long-standing relationship with MITRE and holds deep respect for the unique role that the organization plays within the security ecosystem. MITRE ATT&CK® Evaluations have been instrumental in helping us improve our products. We are grateful for their invaluable contributions in advancing security for all.

After extensive deliberation, Microsoft has decided to not participate in the evaluation this year. This decision allows us to focus all our resources on the Secure Future Initiative and on delivering product innovation to our customers. We look forward to continuing our collaboration with the MITRE team and wish them all the best for this year’s evaluation.

Behavior monitoring is now generally available for Microsoft Defender for Endpoint on macOS

JoshBregman — Tue, 10 Jun 2025 20:17:04 GMT

Enhancing macOS security with behavior monitoring

As attackers become more sophisticated in today’s rapidly evolving threat landscape, security strategies must continue to innovate to keep pace. For instance, static signature-based approaches to malware detection are useful but not enough. Rather, when combined with more dynamic forms of detection like behavior monitoring, your environment is better equipped to block new and evolving threats.

Behavior monitoring observes how software behaves in real-time to detect and analyze potential threats based on the behavior of the applications, daemons, and files within your system. Behavior monitoring is a cornerstone of Microsoft Defender’s cloud-based protection strategy. A wide array of our most advanced protection capabilities rely on behavior monitoring’s cloud models to not only detect but also effectively respond to complex and evolving threats.

Today, we’re excited to announce that behavior monitoring is now generally available on macOS, and is rolling out broadly over the course of the next few weeks. Like with Windows and Linux, behavior monitoring for macOS extends Defender for Endpoint’s protection beyond static signatures to track the larger scale relationships between processes. This capability significantly enhances the early detection of suspicious or malicious activities by spotting unusual process interactions and patterns.

What does this mean for customers?

By extending this critical technology to macOS, customers will benefit from a consistent level of protection across all of their devices. Behavior monitoring introduces a rich new stream of telemetry that helps lay important groundwork for advancing innovative protections against threats targeting macOS users. In the future, it will be possible to build custom logic based on the process and file system events supported by behavior monitoring, equipping you with a more dynamic and tailored way to secure your endpoints.

Real-world example of behavior monitoring

Let's understand the significance of this feature. The Atomic macOS Stealer (AMOS) is a sophisticated macOS malware engineered to steal sensitive information from systems. It targets a broad spectrum of data, including Keychain passwords, system information, files from desktop and documents folders, macOS user passwords, browser data (such as cookies and login credentials), and cryptocurrency wallets. To evade detection, AMOS employs obfuscation techniques like XOR encryption, making its payloads challenging to identify through static analysis alone. Due to its advanced nature, effective detection of AMOS necessitates dynamic analysis and behavior detection methods, rather than relying solely on static signature-based approaches.

Behavior monitoring alerts are displayed in the Microsoft Defender XDR portal alongside all other alerts, enabling effective investigation.

The following image in the Microsoft Defender XDR portal shows that Defender detected and terminated a suspicious action using behavior monitoring on macOS.

The following image is an alert in the Microsoft Defender XDR portal that shows that a suspicious action was blocked using behavior monitoring technology.

To experience the Mac antivirus behavior monitoring and blocking, users will need a minimum version Microsoft Defender for Endpoint, which is 101.25032.0006.

Availability

Our macOS behavior monitoring and blocking capabilities are available on the following major versions of Mac currently supported by Microsoft Defender for Endpoint:

macOS Ventura (13)

macOS Sonoma (14)

macOS Sequoia (15)

Behavior Monitoring is being rolled out automatically following our safe deployment practices (SDP) per the schedule below.

Channel	Staring Date	App Version
External	3/31/2025	> 101.25042.0002
Production	5/19/2025	> 101.25032.0006

Once fully deployed, behavior monitoring will be on by default for everyone. You can confirm your device’s enrollment status by checking the output of mdatp health --details features in your terminal.

If your device is not yet enabled automatically, you can enable it manually.

Enabling Behavior Monitoring

For customers that need to change the settings of behavior monitoring, you can use Intune or a 3rd party MDM for enterprises or manually using sudo mdatp config behavior-monitoring for a trial deployment. Support for behavior monitoring in Defender for Endpoint’s security settings management experience is expected this summer.

Additional resources for securing macOS with behavior monitoring

The following resources can help you optimize your macOS security and behavior monitoring settings:

Refer to the following article for more details about configurations related to behavior monitoring.

Monitor the What's new in Microsoft Defender for Endpoint on Mac page for upcoming announcements.

Read this blog to learn more about how behavior monitoring works on Linux.

We welcome your feedback and look forward to hearing from you! You can submit feedback through the Microsoft Defender XDR portal.

Learn more

Manage global exclusion policies for Linux across both AV and EDR

Rutuja_dange — Thu, 05 Jun 2025 16:36:57 GMT

Create and manage global exclusions for Linux

Global exclusions for Microsoft Defender for Endpoint on Linux are now generally available. This will allow security teams to create and manage exclusion that apply to both antivirus (AV) and endpoint detection and response (EDR)—helping reduce false positives, improve performance, and streamline security operations on Linux servers.

Many organizations rely on exclusions to maintain optimal performance and ensure compatibility—especially in Linux server environments running custom applications or handling high input/output workloads. Until now, the absence of a unified exclusion scope across both AV and EDR made it challenging to tackle performance issues and avoid disruptions to trusted software due to false positives.

With global exclusions, organizations can now effortlessly exclude specific files, folders, and processes from both AV and EDR using a single, centralized configuration—ensuring consistent protection, improved accuracy, and better performance across their Linux workloads.

Key benefits

Unified scope for antivirus + endpoint detection and response: Apply exclusions across both antivirus and endpoint detection and response using a single exclusion scope called “Global”.

Mitigation of performance issues: Helps address performance issues—such as high CPU and memory usage—by excluding noisy processes.

Reduced false positives: Avoid flagging known and trusted files or custom applications unique to your environment. By excluding trusted files and processes—such as Tanium used in endpoint management—you can avoid incorrect detections and focus on high-fidelity signals.

Centralized, scalable management: Configure exclusions via security settings management using the Defender portal, Microsoft Intune, or JSON-based policies.

How it works

Global exclusions in Microsoft Defender for Endpoint for Linux are applied at the sensor level. This early-stage filtering helps eliminate noise from trusted sources before any pre-processing by antivirus or endpoint detection and response engines. By default, these exclusions apply to real-time protection and passive mode, but not to on-demand custom scans. Here’s the summary of how it works:

Scope: Applies to both real-time protection and EDR detections on Linux. It does not impact on-demand scans.

Supported types: You can exclude files, folders and processes

Configuration options:

- Microsoft Defender portal: Use the built-in security settings management experience.
- Microsoft Intune: Use the endpoint security blade to define and deploy exclusion policies.
- JSON-based policies: For advanced deployments, exclusions can be defined in managed JSON and deployed via configuration management tools.

This flowchart shows when and where global exclusions are applied in the context of Microsoft Defender for Endpoint on Linux.

Getting started

For detailed guidance on how to configure, validate, and manage global exclusions, please refer to our documentation: Configure and validate exclusions for Microsoft Defender for Endpoint on Linux - Microsoft Defender for Endpoint | Microsoft Learn.

To start using global exclusions for Microsoft Defender for Endpoint on Linux, please upgrade to the latest version 101.24092.0001 or above.

Discover how automatic attack disruption protects critical assets while ensuring business continuity

DorFenigshtein — Tue, 27 May 2025 18:40:02 GMT

Protecting critical assets

Traditional security solutions often operate in a one-size-fits-all alert model that treats every detection equally, regardless of how important the asset is. But not all assets are equal. Critical assets are systems governing access, identity, or sensitive data. They are essential to an organization’s operations and security, for example, domain controllers, cloud connectivity gateways, key management servers, and others. If attackers compromise these assets, business continuity suffers at great scale. As these systems typically have less routine activity, any alert on them is far more significant.

Threat actors specifically target these high-value systems, meaning that even weaker signals need to be properly investigated. With short-staffed SOC teams, it has historically been a challenge to respond to these types of signals effectively. Given assets like domain controllers are the backbone to an organization’s daily operations, protecting critical infrastructure means proactively stopping adversaries before they inflict damage. So how do security solutions help SOC teams effectively protect critical assets while ensuring business continuity?

To help security teams meet this challenge, Microsoft Defender developed automatic attack disruption: a built-in self-defense capability that identifies & disrupts multi-domain attacks in near real time to prevent further damage across the organization. We recently announced how we protect domain controllers against ransomware as the latest attack disruption innovation.

Behind the scenes, attack disruption uses a critical asset framework to achieve this outcome. This framework is developed from the latest threat research and tested internally within Microsoft’s security infrastructure to provide the context needed to differentiate true threats from noise for critical assets, empowering organizations to act decisively when it matters most. Using the native integration between Microsoft Defender for Endpoint and Microsoft Security Exposure Management, we can automatically identify critical assets in your environment and apply deep contextual insights based on each asset’s unique threat profile to disrupt attacks accordingly.

This blog post dives into how this framework drives real impact, its core components, innovative methodology, and how it helps ensure that organizations are proactive and efficient in their defense strategy specifically for critical asset protection.

Real world impact

By applying the critical asset framework, Microsoft Defender was able to disrupt attacks targeting high-value assets several days earlier in the kill chain in 40% of triggered incidents. This early intervention significantly reduces attacker dwell time, helping prevent impact and limit damage. Additionally, in another 40% of incidents, risk-based contextual insights transformed weak signals into clear, actionable disruption opportunities. These were unique incidents, false negatives in the past, that are now being surfaced and mitigated for the first time.

Neutralizing a human-operated attack on a global enterprise’s domain controller

In this scenario, a global enterprise was running multiple endpoint detection & response vendors in their environment, including Microsoft Defender for Endpoint. The organization was targeted by an advanced, human-operated attack on their domain controllers. Only Microsoft’s solution was able to stop the attack thanks to Defender’s early detection and disruption capabilities. The threat was neutralized before any damage could be inflicted, demonstrating the necessity of automatic attack disruption in the fight against ransomware. Meanwhile, critical assets onboarded to the other vendor were impacted.

Attack story showing automatic attack disruption saving domain controllers onboarded to Microsoft Defender for Endpoint whereas those onboarded to a different EDR solution were encrypted.

Core principles for protecting critical assets

Now that you’ve seen how effective attack disruption is for protecting critical assets, let’s take a look at the core principles shaping our framework:

Prioritization and classification: By classifying assets based on their criticality and role we ensure that disruption actions are triggered precisely where they matter most. With fewer benign events on critical systems, every detection is more likely to reflect a genuine threat, enabling faster, more targeted responses that directly enhance client security and operational confidence.

Proactive, real-time defense: Our context-driven approach enables early detection and disruption of threats, often stopping attacks days before they can cause significant harm.

Adaptive and scalable: Although our initial focus has been on domain controllers, the framework is designed to be flexible and protect a variety of other critical assets such as cloud connectivity solutions and publicly connected devices, based on each asset’s unique behavioral context.

We take these principles and translate them into actionable detection and disruption actions tailored to protect critical assets from the sophisticated and persistent threats that they frequently face.

Under the hood of critical asset protection

Asset classification: Our process starts by analyzing each asset’s role and criticality using Microsoft Security Exposure Management to identify and prioritize critical assets, guiding every disruption decision along the way.
Detector integration and management:
- Targeted detector selection: We have engineered a specialized set of detectors most relevant to high-value assets, guided by extensive asset-specific threat research. This ensures each critical asset is protected by detectors selected specifically for the threats it faces.
- Automated quality evaluation: Our system continuously assesses each detector’s signal-to-noise ratio and overall impact, deploying only those that meet our strict standards.
- Integrated security platform: A dedicated module orchestrates every step - from generating alerts and enriching them with context to automatically triggering the right containment or remediation action via one streamlined workflow.
Contextual disruption execution: When a detector triggers on a critical asset, our framework immediately enriches the alert with detailed contextual telemetry. This enriched data is leveraged in several powerful ways. For example, events are correlated to accurately identify any impacted users - even when initial detections lack clear user data (such as when a malicious payload runs under the SYSTEM account via a service, where our framework traces the creator of the service). The framework also assesses remote activity to capture additional related entities, applying tailored threat lists specific to each asset type. These examples demonstrate how our context-driven approach transforms raw detections into precise, actionable intelligence that enable targeted responses like user containment and soon, IP containment for critical assets.

Where we’re heading

As the threat landscape evolves, we continue investing in attack disruption’s ability to protect critical assets. Our roadmap includes:

Scaling through AI-driven behavioral coverage: We’re shifting from a detector-centric approach to an AI-driven model that continuously learns from vast volumes of telemetry and behavioral patterns. We’re shifting the framework to identify and disrupt threats dynamically, improving precision, expanding coverage, and adapting faster than static rules ever could.
Extending asset coverage: Beyond domain controllers, upcoming iterations will include additional high-value assets such as Entra Connect Sync servers, internet-facing servers, SQLs servers, and more - providing comprehensive protection across your organization’s critical infrastructure.
Deepening integration: This innovation has been made possible through the integration between Microsoft Defender for Endpoint and Microsoft Security Exposure Management, which provides advanced asset classification. Our ongoing partnership ensures we continue to innovate and deliver tailored solutions that address unique client needs.

Conclusion

The ability to protect critical assets represents a paradigm shift in cybersecurity, moving from reactive alerting to proactive, context-aware disruption that prioritizes not just alerts, but the assets themselves. By recognizing that not all assets carry the same risk, our approach ensures that protection efforts are focused where they matter most, enabling true end-to-end defense. By integrating advanced asset classification and context-driven intelligence into our security platform, we’re not only protecting critical systems like domain controllers but also empowering customers with decisive, actionable insights.

As we continue to innovate, our commitment remains clear: to deliver intelligent, effective security solutions that safeguard your most vital assets against even the most advanced threats.

Learn more

Explore these resources to stay updated on the latest automatic attack disruption capabilities and how we protect critical assets:

Learn more about Microsoft Defender for Endpoint.

Read our latest security blog on how we protect against ransomware attacks using domain controllers.

Read about the new containment features.

Learn how attack disruption safeguards your domain controllers in this video.

Check out our latest infographic.

Read about automatic attack disruption.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Defender for Endpoint successfully passes the AV-Comparatives 2025 Anti-Tampering Test

amibarayev — Thu, 15 May 2025 17:21:19 GMT

The rise of tampering attacks

In cybersecurity, anti-tampering protection refers to the defensive measures designed to prevent unauthorized modifications to security systems, policies, and settings. When threat actors compromise an organization, they often start by tampering with security solutions in an effort to further exploit and achieve persistence within the environment. Common tampering tactics include disabling or altering antivirus and endpoint detection and response (EDR) tools, turning off real-time protection and security intelligence updates, editing high-value device and access policies, and creating exclusions that allow malicious activities to go undetected. After having tampered successfully, attackers gain valuable time to install malicious tools, exfiltrate data, move laterally, and launch ransomware attacks.

In recent years, Microsoft has observed a significant volume of attacks involving antivirus tampering. In May 2024 alone, Microsoft Defender XDR detected over 176,000 incidents involving tampering with security settings, impacting more than 5,600 organizations ¹. On average, during that time frame, organizations that encountered tampering activity saw over 31 attempts. Techniques observed by Microsoft include Windows Registry modifications, use of malicious tooling such as NSudo (Defeat Defender), Defender Control, Configure Defender, ToggleDefender, custom malicious PowerShell or batch scripts, and driver tampering.

Defender for Endpoint effectively thwarts tampering attacks

Microsoft Defender for Endpoint offers robust anti-tampering capabilities that protect against end-user and third-party security settings changes, even in the context of a privileged user. These built-in controls can prevent local and non-authorized remote administrators from altering critical settings at the organizational, platform, and device levels – you can even create specific rules for high-value device types such as domain controllers. This means that you are automatically protected against common tampering tactics used by attackers including the modification of registry settings, DLLs, file systems, and agents. On top of that, any attempt to create exclusions in your antivirus and EDR tools or to terminate or suspend your system processes and services will be thwarted. These settings are on-by-default for all Defender for Endpoint customers, delivering comprehensive anti-tampering protection from day one.

We are pleased to announce that AV-Comparatives has certified Microsoft Defender for Endpoint for successfully thwarting all tampering attempts levied during the 2025 Anti-Tampering Test. The test involved rigorous evaluation of security solutions to defend against sophisticated attack techniques aimed at disabling or bypassing protection mechanisms. This includes attempts to disable or modify Windows kernel components and disable or terminate processes in the Windows user space. Even under sustained attack (various tests, tools, and procedures designed to penetrate our anti-tampering controls), Defender for Endpoint demonstrated its ability to maintain protection. This evaluation not only validates the effectiveness of our advanced tampering and defense evasion controls but also reinforces Defender for Endpoint’s position as a leader in endpoint detection and response.

Defender for Endpoint successfully thwarted 100% of the tampering attacks made against the categories shown above in AV-Comparatives 2025 Anti-Tampering Test

Learn more

Explore the following resources to learn more about how Defender for Endpoint defends against tampering attacks:

Protect security settings with tamper protection

Protect your organization from the effects of tampering

See additional evaluation results for Defender for Endpoint, demonstrating the industry-leading effectiveness of our endpoint security solution:

Microsoft is named a Leader in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

Microsoft Defender XDR demonstrates 100% detection coverage across all cyberattack stages in the 2024 MITRE ATT&CK® Evaluations: Enterprise

Forrester names Microsoft a Leader in the 2023 Endpoint Security Wave™ report

AV-Comparatives awards 2024 for Microsoft

AV-Comparatives antivirus tests performed on Microsoft Defender

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹ Microsoft Digital Defense Report 2024

Sensor Disconnection Notifications with Microsoft Defender for IoT and Microsoft Sentinel 🚀

BelleKriger — Fri, 12 Dec 2025 10:46:35 GMT

What Does This Playbook Do?

This new automated playbook sends real-time email notifications whenever a sensor disconnects from the cloud. This ensures you’re immediately alerted if there’s an issue, allowing you to take quick action to investigate and resolve the problem.

Why It’s Important:

Real-Time Alerts: Get instant notifications when a sensor goes offline.
Proactive Monitoring: Identify the issue early, reducing downtime and improving response times.
Seamless Integration: Works effortlessly with Microsoft Defender for IoT and Microsoft Sentinel for a unified security approach.

How to Set It Up:

Setting up this playbook is quick and easy. For step-by-step instructions, check out the detailed setup guide here.

This playbook was created in collaboration with Marian Hristov, a leading partner working with Defender for IoT.

Block malicious command lines with Microsoft Defender for Endpoint

SaadK — Thu, 20 Feb 2025 01:12:17 GMT

The modern threat landscape is rapidly evolving, with new attack strategies being employed at greater frequency and volume than we have seen in the past. One such tactic we have recently observed across many advanced malicious attacks is the use of harmful command lines within the attack chain to bypass file-based detections. A common technique involves using legitimate programs like powershell.exe or cmd.exe to execute malicious actions, such as downloading and running a payload or initiating a harmful script. Today we will discuss how Microsoft Defender for Endpoint protects against these threats by scanning and blocking malicious command lines. While this capability is already generally available, it continues to benefit from improvements to its machine learning models.

Defender for Endpoint uses advanced machine learning models to automatically scan, analyze, and classify command lines. Malicious command lines are blocked instantly within the client, while suspicious ones are sent to the cloud for further analysis using Microsoft’s freshest signals, most up-to-date threat intelligence, and advanced detection methods - including the CommandLineBerta model. This model evaluates suspicious command lines to determine the probability that they are malicious. If they are classified as malicious, they are blocked. What differentiates this machine learning model from others is that it can classify any command line, unlike models that are trained for specific subsets like PowerShell or Windows Management Instrumentation (WMI) command lines. As a result, it provides protection against a wide variety of malicious command lines. The CommandLineBerta model is regularly updated to stay ahead of emerging threats and is particularly effective against LoLBin (Living off the Land Binary) attacks, where adversaries use legitimate programs within the victim's machine to achieve their malicious goals.

Here are a few other examples of command lines blocked by CommandLineBerta:

Malicious coin miners which use long command lines containing wallet addresses.

Malware that uses command lines to execute malicious code hosted on public websites such as Pastebin or Github.

Command lines that run malicious scripts like PowerShell, Wscript, VBScript etc.

Malware that tampers with security software to avoid detection.

Malware that executes Dynamic Link Libraries (DLLs) with custom exports.

When any malicious command line is blocked, Microsoft Defender for Endpoint surfaces an alert on the Microsoft Defender XDR portal and provides a notification of blockage on the affected device.

With cyberattack data from over one billion protected endpoints and one of the most robust threat intelligence clouds that exists today, Microsoft is uniquely positioned to identify and respond quickly to attack strategies like malicious command lines.

More information:

Learn more about the advanced technology at the core of Microsoft Defender Antivirus.

Get started with Microsoft Defender for Endpoint.

Learn about what’s new in Microsoft Defender for Endpoint.

Get greater visibility with aggregated reporting of endpoint telemetry signals

SaarCohen — Wed, 22 Jan 2025 22:20:06 GMT

Endpoint security solutions collect large amounts of data from across your network in order to detect intruders. These signals are quickly processed to generate prompt, valuable security alerts and insights with a high signal-to-noise ratio while allowing operational continuity. During this process, certain data is typically dropped to reduce noise and optimize product performance and efficiency. This allows more complex signal logic to be applied to the significant data that is collected. With this approach, signals are continually filtered until high fidelity indicators of attack or compromise are found.

Historically Microsoft Defender for Endpoint has taken this approach and opted against preserving redundant and irrelevant signals, choosing to highlight the higher fidelity signals that matter most to SOC analysts. With that said, some of you have shared that you would like the option to review all collected signals.

Our goal as an endpoint security solution is to provide you with transparency and confidence, so we’re pleased to announce that aggregated reporting of system activity is now available in Defender for Endpoint in public preview. This feature ensures that essential event properties valuable to investigation and threat hunting activities are continuously collected for key activities, signals, and events. As always, we strive to keep you in control, so switching on this feature for greater visibility is optional.

What you can expect:

Summarized information for supported event types, including otherwise low efficacy telemetry that can be used for investigations and threat hunting.
All the telemetry that you are used to seeing today.

Note that since this feature improves signal visibility, your SIEM or storage solutions may incur higher storage costs if you stream Microsoft Defender for Endpoint Advanced Hunting tables (such as to Sentinel). The exact increase varies by organization.

To enable this feature and for more information, technical details, and guidance, please visit: Aggregated reporting in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn

Defender for Endpoint extends support to ARM-based Linux servers

Megha_Priya — Thu, 17 Apr 2025 16:21:03 GMT

As the demand for ARM64 servers continues to rise, we are thrilled to announce that Microsoft Defender for Endpoint now supports ARM64 based Linux servers in GA. This update marks a new milestone in our commitment to providing comprehensive endpoint security across all devices and platforms.

ARM64 processors are rapidly gaining traction due to their exceptional efficiency and performance, particularly in data centres and cloud environments. Defender for Endpoint’s Linux solution is built specifically for Linux devices, so our protection is tailor-made with the particular needs and uses of Linux devices in mind.

What’s Included in the GA?

Microsoft Defender for Endpoint for ARM-based Linux servers supports all the capabilities it currently supports on x86_64 processor-based Linux Servers:

Antivirus (AV) protection
Endpoint Detection and Response (EDR)
Vulnerability Management
Response Actions

Device Isolation
Live Response
AV Scan

Configure policies via Security Settings Management
Advanced Hunting

List of supported Linux distributions on ARM64:

Ubuntu 20.04 ARM64
Ubuntu 22.04 ARM64
Ubuntu 24.04 ARM64
Debian 11, 12 ARM64
Amazon Linux 2 ARM64
Amazon Linux 2023 ARM64
RHEL 8.x ARM64
RHEL 9.x ARM64
Oracle Linux 8.x ARM64
Oracle Linux 9.x ARM64
SUSE Linux Enterprise Server 15 (SP5, SP6) ARM64

Get Started Today

To begin using Defender for Endpoint on Linux ARM64 devices, download the Defender for Endpoint agent version “101.25022.0004” from the production channel.

You can choose one of the below methods to deploy Defender for Endpoint on your ARM64 servers as per your environment needs:

Automate Deployment using Installer Script or 3^rd Party Tool – Ansible, Puppet.
Automate Deployment via Microsoft Defender for Cloud for Azure, AWS, GCP VMs and on-premise VMs using Azure Arc

Refer to public doc for pre-requisites and deployment guidance.

Feedback and Support

We value your feedback and encourage you to share your experiences and any issues you may encounter. For any questions or to report bugs, please reach out to Microsoft support.

Looking Ahead

We plan to extend support to a few more Linux distributions like Alma, Rocky in near future.

Protect your single-core Linux servers with Defender

Rutuja_dange — Thu, 12 Dec 2024 20:13:59 GMT

In today’s rapidly evolving digital landscape, enterprises are increasingly relying on Linux-based servers to run their critical workloads. Securing your Linux servers is paramount to safeguarding sensitive data, ensuring business continuity, and maintaining trust with your customers.

But what about balancing performance with security? Many organizations are running a diverse server infrastructure and rely on low-resource configurations due to various constraints. Optimizing security for single-core or dual-core systems without compromising performance is a key challenge. As organizations continue to innovate and diversify their server estates, the need for cybersecurity solutions that scale across both high-performance and low-resource configurations is greater than ever.

Today, we’re excited to announce that Microsoft Defender can now be deployed to low-resource Linux environments, including single and dual core configurations to meet the diverse needs of organizations.

Intelligent performance optimization

Microsoft Defender uses a sensor framework powered by eBPF (extended Berkeley Packet Filter) technology, when deployed on Linux servers. Unlike traditional security solutions that rely on kernel modules, eBPF allows Microsoft Defender to monitor system activities in a lightweight and non-intrusive manner, enhancing efficiency without compromising security—even in low-resource environments. Today the eBPF sensor consumes less than 1% CPU on average when installed on Linux machines.

Key to our ability of maintaining system performance is our intelligent performance optimization. It ensures that Defender stays within memory and CPU limits, by adaptively managing resource consumption and ensuring that security measures do not interfere with essential processes. Additionally, we incorporated smart data collection and preprocessing, which helps make sure only relevant data is processed, further reducing system resource consumption.

Lastly, a rich exclusion framework allows administrators to tailor security settings and exclusions, so critical applications and processes can operate unhindered while still achieving a strong security posture.

Our architecture combines eBPF, intelligent data processing, and configurable exclusions, to ensure that Microsoft Defender is an effective solution for performance-sensitive Linux workloads. It provides real-time protection with behavioral monitoring and threat detection, without sacrificing efficiency, even on low-resource configurations.

Enterprise-grade security for all platforms

Insights from Microsoft’s research teams show that a common reason for compromise is that organizations didn’t protect their servers as part of their endpoint security deployment and strategy. But for security to be effective, it must cover the entire endpoint estate across end user devices, mobile and IoT devices, and server workloads - on-premises and in the cloud.

Microsoft Defender provides AI-powered endpoint security for all platforms - including Windows and Linux servers - with industry-leading antivirus, intelligent real time protection and the most comprehensive detection, and response experience within Microsoft’s unified security operations experience.

More information

Start protecting your servers today with a free trial.
Learn more about Defender for Servers and get started today.
Check out our documentation to learn more about deploying Microsoft Defender on Linux devices.

The unified agent now combines protection across endpoints, OT devices, identities, and DLP

clairelevy — Tue, 19 Nov 2024 17:15:53 GMT

Microsoft’s investments in Defender for Endpoint focus both on building industry-leading endpoint protection to stay ahead of increasingly sophisticated attackers and delivering on key fundamentals like simplified deployment and a unified platform experience. This year at Microsoft Ignite, we’re announcing innovations in both categories: a new unified agent that makes it simpler to deliver both endpoint protection and ITDR, as well as innovative and unique capabilities that help outsmart increasingly challenging attack tactics.

One platform, one agent: Streamline your deployment and protection with a single agent across endpoint, OT, identity, and data loss prevention
Expanded automatic attack disruption: Automatic containment of compromised, critical infrastructure assets like servers, while ensuring business continuity

Streamline deployment with a single agent across endpoints, OT devices, identities, and DLP

From a cybersecurity lens, an “agent” or “sensor” is a software component that monitors and protects critical infrastructure. Serving as one of the first lines of defense against threat actors, they continuously scan corporate resources for malicious activity or misconfigurations to ensure your organization remains secure and provide critical telemetry for security analysts. At the same time, multiple agents cause deployment and maintenance overhead for security teams.

Last year at Microsoft Ignite we unveiled that we are bringing the power of Microsoft Sentinel together with Microsoft Defender XDR to deliver a unified security operations platform. Today, we’re excited to share that we are taking our platform approach to the next level with the only platform-level agent that unifies endpoint, identity and OT protection, and Data Loss Prevention (DLP). The streamlined agent simplifies how you activate and manage core capabilities within the Defender XDR experience to more easily and swiftly reap the benefits of our AI-powered protection.

Image 1: The new, unified agent

The single agent infrastructure is built on the market share-leading endpoint protection solution – Microsoft Defender for Endpoint. By unifying deployment and telemetry across this broad range of solutions, customers benefit in multiple ways:

Simplified and safe deployment practices: Deploy once and simply enable each solution as needed, while relying on the mature safe deployment practices used by Defender for Endpoint and gives admins full control over sensor updates.
Microsoft’s unified security operations platform: All agent telemetry is automatically correlated within the unified platform, enabling cross-workload investigation, hunting, and access to the ITDR dashboard with key identity insights.
Integrated identity prevention and protection: Get a comprehensive view of all on-premises identities and identity-related information across your organization, identity-specific posture recommendations, and powerful detections, tailored to identify key identity-based threats.
Streamlined triage: The integration of identity information into the device page enables easy mapping of a device to associate identity/owner through a direct connection to AD and Entra ID services for verification and now makes endpoints with the same device name easily distinguishable.
Automatic attack disruption: Identity-specific insights will enable automatic attack disruption against additional, identity-related attack types, such as adversary in-the-middle campaigns.

GIF: Sensor activation via the unified agent

Defender for Endpoint customers can now easily deploy Defender for Identity by simply enabling it from the Defender portal and immediately start defending against on-premises identity attacks. It comes pre-installed on Windows devices and has a simple deployment process for all other platforms including Linux and macOS. Starting today, this new deployment method is available for Domain Controllers running Windows Server 2019 and newer versions, with more support for older versions coming in the next months.

Contain attackers on critical infrastructure assets without disrupting business productivity

Over the last 18 months, we’ve seen a gigantic jump of 2.75x in the number of organizations targeted by ransomware attacks. Thankfully, over the same period, and even in this tougher environment, the likelihood of Defender for Endpoint customers getting encrypted decreased by an even greater amount, 3x. A key driver in this success has been automatic attack disruption, a response capability unique to Microsoft.

We’re continually investing in automatic attack disruption to stay ahead of this challenging landscape, and this year at Ignite, we’re excited to announce disruption of critical infrastructure assets like domain controllers and other servers that organizations run on - an expansion of our capabilities that addresses a key challenge we’ve observed in the real world.

While server protection is increasingly becoming a focus area for organizations, historically it’s been difficult to contain attackers on these assets because of their importance to business productivity. Therefore, standard security practice is often to leave servers operational when compromise is suspected in order to ensure business continuity. Instead, the approach has been to contain the compromised user account associated with the breach. This can be effective, but it leaves room for attackers to continue to pivot by coopting or creating new users, rather than fully shutting down the attack.

To address this challenge, Defender for Endpoint can now fully contain attacks on critical infrastructure assets while leaving them operational, so that business activity can continue. Rather than isolating the devices altogether, we identify the malicious connections running from or to these assets and granularly block the activity itself, while otherwise keeping them running as usual.

Let’s look at an example of a common attacker practice on domain controllers (DC) – servers that manage user authentication and access to network resources. When attackers gain access to a DC they often establish a remote desktop protocol (RDP) session to gain access to network resources and gain a foothold to launch further attacks. If you were to shut down the DC, all users in your organization would lose access to company resources and could no longer log in – leading to a complete loss in productivity.

So instead, Defender for Endpoint now identifies attacker-established RDP sessions and automatically disables them while allowing the server itself to remain operational. This way, uncompromised users and devices in your organization can continue to log in and conduct business normally without the attacker being able to reach them.

Image 2: DC contained and 5 devices protected

This expansion of our automatic attack disruption capabilities gives organizations a significant leg up when defending their most critical infrastructure assets and it’s the latest example of our commitment to prioritizing the delicate balance between effective attack disruption and business productivity.

We hope you’ll join us online or in person for our Microsoft Ignite session to hear more about the unified agent, attack disruption on critical assets, and other ways we’re investing in delivering cutting-edge endpoint protection and simplified security management. Our work is never done, and we’re committed to continually innovating to provide best-in-class endpoint protection. To that end, continue to share your feedback and priorities, and we look forward to connecting with many of you this week.

More information

Join us online or in person and watch these new capabilities in action during this Microsoft Ignite session AI-Driven Ransomware Protection at Machine Speed: Defender for Endpoint
Want to know what other Threat Protection innovations are new at Ignite? Check out our XDR blog
Learn how to deploy Defender for Identity with the unified agent

Security settings management is available for multi-tenant environments in Microsoft Defender XDR

maayanmazig — Mon, 30 Sep 2024 14:25:32 GMT

Several months ago, we released device security settings management within Microsoft Defender XDR. This experience enables security administrators to configure Microsoft Defender for Endpoint security settings for devices on all platforms (including Windows, Linux, and Mac) without having to leave the Defender portal. The streamlined portal experience breaks down the wall between Security and IT teams by presenting a shared view for both, making it easier for security administrators to strengthen the security posture of their devices.

Security administrators can now drive even greater efficiencies with simplified security settings management supporting multi-tenancy environments that are common to large enterprises and managed services security providers (MSSPs). The multi-tenant view in the Defender XDR portal (Multi-tenant management in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn) provides security administrators a consolidated view of all security policies across their entire organization, including all tenants' policies, without needing to switch portals. To access this page, navigate to Endpoints > Configuration Management > Endpoint Security Policies.

Additionally, security administrators can create, edit, or delete policies within the context of the specific tenant centrally via the unified aggregated view.

From the Endpoint Security Policies page, a security administrator can search for a specific policy for all their tenants, using the Search function.

To manage security settings for multiple tenants in the multi-tenant view in Defender XDR portal, security administrators must follow all the prerequisites to configure security settings for a single tenant for each of their tenants (for more details please see: Use Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune | Microsoft Learn). This includes the following role-based access control requirements:

For Microsoft Defender, use the security administrator role (or custom role with security configuration management permissions scoped to all devices)
For Microsoft Intune, use the Endpoint security manager role

Additionally, the devices in each Defender tenant must be affiliated with the corresponding Entra tenant

This experience does not currently support Microsoft Defender for Business tenants.

For more information and guidance, please visit: Endpoint security policies in multitenant management - Microsoft Defender XDR | Microsoft Learn

Microsoft Defender for Endpoint’s Safe Deployment Practices

JasonWeber — Fri, 16 Aug 2024 01:08:07 GMT

For customers it is key to understand that software vendors use safe deployment practices that help them build resilient processes that maintain productivity. This blog addresses Microsoft Defender for Endpoint’s architectural design and its approach to delivering security updates, which is grounded in Safe Deployment Practices (SDP).

Microsoft Defender for Endpoint helps protect organizations against sophisticated adversaries while optimizing for resiliency, performance, and compatibility, following best practices for managing security tools in Windows.

Security tools running on Windows can balance security and reliability through careful product design, as described in this post by David Weston. Security vendors can use optimized sensors which operate within kernel mode for data collection and enforcement, limiting the risk of reliability issues. The remainder of the security solution, including managing updates, loading content, and user interaction, can occur isolated within user mode, where any reliability issues are less impactful. This architecture enables Defender for Endpoint to limit its reliance on kernel mode while protecting customers in real-time.

Image 1: Defender for Endpoint integration into Windows architecture

In the remainder of this blog post, we outline Microsoft’s use of safe deployment practices for Defender for Endpoint, our 1^st party endpoint protection solution.

Defender for Endpoint applies safe deployment practices to two distinct update mechanisms:

Software and driver updates that are updated monthly (and potentially can update kernel-mode components).
Security intelligence and detection logic updates that may be updated multiple times per day and apply only to user-mode components.

This blog outlines in-depth how Defender for Endpoint approaches SDP and what customers can do to manage their own roll-out process for an additional layer of control.

1. Software and driver updates

Defender for Endpoint releases monthly software and driver updates that add new functionality, improve existing features, and resolve bugs. Defender for Endpoint’s kernel drivers capture system-wide signals like process execution, file creation, and network activity. These drivers are updated through Windows Update, over a gradual and staged deployment process after spending weeks in stabilization and testing. The deployment evaluation monitors key metrics like reliability, performance, battery, application compatibility, and more across hardware and software configurations.

Image 2: Process for rolling out software and driver updates for Defender for Endpoint

Microsoft safeguards

All code and content changes go through engineering release gates along with extensive validations and stability testing. After the certification and validation process, Microsoft ships the updates through multiple groups of devices known as stabilization rings. The first stabilization ring targets Microsoft’s hundreds of thousands of employees and millions of internal devices. This helps ensure we discover and address issues first, before customers.

Within each ring, we closely monitor quality signals such as product behavior and performance, false positives, as well as functional and reliability issues, before proceeding to roll out the update to a broader set of devices. Customers can control the rings that are assigned to their device groups, including early access groups, to see how each update may interact with their devices and provide feedback to Microsoft before it is released.

Once internal testing is successfully completed, Microsoft then releases the updates externally in a staggered manner to ensure stability. During this time, Microsoft continuously monitors the rollout. That way we can quickly respond and remotely resolve any issues by reverting or reissuing update packages.

Customer controls

In addition to Microsoft’s safe deployment practices, organizations can also manage monthly updates with their own safe deployment policies through various controls:

Control the delivery of agent updates to their devices by their device groups and the timing of updates.
Apply patch management software and practices for security component updates that can also arrive in the form of monthly Latest Cumulative Updates (LCUs).
Use manual or automated rollback options to revert or reset components to a last known good state.

2. Security intelligence and detection logic updates

In addition to monthly code updates, Microsoft releases security intelligence updates which are installed on devices to supplement the real-time local and cloud-based machine learning models, behavior analysis, and heuristics that enable Defender for Endpoint to neutralize the latest known cyberthreats.

Given the high frequency at which these updates need to be delivered to protect customers, it’s not possible to deploy these through the same deployment process. Therefore, Defender for Endpoint does not include kernel changes in intelligence updates. Instead, daily updates are only delivered to components that run in the user mode of the operating system. This approach helps mitigate the risk of these more frequent updates from impacting the broader operating system and, in the unlikely event of an error, limits the risk of significant negative effects like system crashes and ensures devices can be automatically recovered.

Microsoft safeguards

Similar to the process for software and driver updates, Microsoft ships security intelligence updates after extensive testing and rolls them out starting with internal devices, early access customers, and then releases them externally in a controlled, gradual manner. We continually monitor telemetry and can mitigate issues through the cloud in minutes.

Customer controls

Customers can also manage security intelligence updates with their own safe deployment policies through various controls:

Stage updates through corporate networks or software management solutions.
Apply updates at a lower frequency for critical systems. Daily releases can be applied at a lower frequency for certain device groups, including servers critical to running your infrastructure.
Use rollback controls. As a last resort, it's possible to revert or reset components to a last known good state using rollback controls.

Microsoft has long invested in safe deployment practices and established a robust SDP model in how we deliver updates to customers of Defender for Endpoint. In addition, customers have full control over how updates are delivered and how controls are applied to their device estate. This model of shared control helps ensure security and resiliency.

Resources

To start a free, 90-day trial of Defender for Endpoint, sign up here.
To learn more about how you can control rollout of Defender for Endpoint’s updates and join early access groups, check out these resources for Windows, Mac, and Linux.