Microsoft Defender ATP [Attack Simulation & Investigation] Demos

[Ammar Hasayen]

Hi Community, 

If you are new to Microsoft Defender ATP or want to see a series of demos on how the product can help your organization, check out this:

• Demo 1/6 - MS Defender ATP - On-board Machine
• Demo 2/6 - MS Defender ATP - Deliver Malware
• Demo 3/6 - MS Defender ATP - Detect & Response
• Demo 4/6 - MS Defender ATP - Collect Investigation Package
• Demo 5/6 - MS Defender ATP - Remediation Actions
• Demo 6/6 - MS Defender ATP - Hardening Machines

[#2]

@Ammar Hasayen  thank for the info! However, we are facing an issue when running the Simulation #1 when opening the docm file in Word. AMSI is getting in the way. We did "unblock" the file from the properties of the document and even allowed all macros from the Trust Center.

Any idea how to pass that AMSI security message and finalize the simulation?

Thanks!

Charles

[#3]

@Chuck99  thanks for your feedback.

Im my demo, I am using the latest Windows 10 machine that is not joined tot he domain and does not have any thing installed on it but Office to open the document. I am not sure I did anything special to make that work.