User Profile
mongie105
Copper Contributor
Joined Feb 27, 2020
User Widgets
Recent Discussions
Dealing with "Email reported by user as malware or phish"
We're working through automation of our Defender 365 incidents in Sentinel to try and reduce the operational load on our team. One of the most common incidents we receive is "Email reported by user as malware or phish". We were hoping to use the result of the automated investigation to determine whether the automated action should be approved, but I have no idea how to get the result of the automated investigation into a playbook. Does anyone have any suggestions? How do you deal with these types of incidents? Thanks!5.4KViews1like1CommentDefinitive guide for aligning ASR Rules with ActionTypes?
Hello, We're currently auditing a bunch of ASR rules, and I'm trying to pull out data from advanced hunting so that I can see which rules are safe to enable. I was hoping someone might be able to help with aligning the ASR Rule Names with the ActionTypes used for hunting. I have found several, but there are a few I still haven't figured out. What are the Audited/Blocked "ActionTypes" for the following rules? Block executable content from email client and webmail Block execution of potentially obfuscated scripts Use advanced protection against ransomware Block process creations originating from PSExec and WMI commands Block Office communication application from creating child processes Block Adobe Reader from creating child processes Block persistence through WMI event subscription The documentation points me to the Schema listing in the hunting console, but the only action type listed is AsrOfficeChildProcessAudited. It would be good if someone could add the rest into this list... I have found the following ActionTypes by searching for "ASR*" they all logically line up with their rules. AsrExecutableOfficeContentAudited AsrExecutableOfficeContentBlocked AsrLsassCredentialTheftAudited AsrLsassCredentialTheftBlocked AsrOfficeChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeMacroWin32ApiCallsAudited AsrOfficeMacroWin32ApiCallsBlocked AsrOfficeProcessInjectionAudited AsrOfficeProcessInjectionBlocked AsrScriptExecutableDownloadAudited AsrScriptExecutableDownloadBlocked AsrUntrustedExecutableAudited AsrUntrustedExecutableBlocked AsrUntrustedUsbProcessAudited AsrUntrustedUsbProcessBlocked Thanks, Alex10KViews1like6CommentsConfirmation of when Defender/Defender ATP deletes files
Hi All, We're fairly new to Defender ATP, and one of the things that is particularly frustrating at the moment is that it is unclear from the securitycenter.microsoft.com portal when evidence in a particular alert or incident has been deleted, and when it has just been prevented from running. I know that in some cases, the files are deleted, but there isn't any clear indication in the portal on when this happens. We get A LOT of unwanted software tickets, and it would be significantly easier to process incidents if we could easily see when offending files have been deleted, or when we need to do this ourselves. If this exists and I'm just missing it, I'd love to be pointed to where I can find this information. Thanks, Alex782Views1like0Comments
Recent Blog Articles
No content to show