User Profile
MichaelJMelone
MicrosoftJoined 6 years ago
User Widgets
Recent Discussions
Re: MDE Alert Policy Tuning
Hello KB850VR . Have you looked at our suppression rule capabilities? This will enable you to suppress a specific alert based on conditions you specify. These conditions include device, device group, file hash, command line, folder path, etc. doc: Manage Microsoft Defender for Endpoint suppression rules | Microsoft DocsRe: Use case to check for new installed application on Windows devices
Hello dmarquesgn! I am not 100% sure this will be totally accurate at the moment, but I think you might be able to get newly detected software after a specified datetime by using the export software inventory API. If you look at the parameters in section 1.6.1 you'll notice an option for sincetime. You can also use it without that parameter and you'll be able to get the time it was first seen in the softwareFirstSeenTimestamp field. doc: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-assessment-software-inventory?view=o365-worldwide#1-export-software-inventory-assessment-json-responseRe: Share Your Hunting Challenges!
Great question! This can definitely be a challenge, especially because one patch may be superseded by another. The best official source would be the National Vulnerability Database (NVD) which is run by NIST (https://nvd.nist.gov/vuln/search). As far as advanced hunting goes, this is not currently available in the product today - but definitely makes a great feature request. We will definitely keep this in mind!Re: Share Your Hunting Challenges!
Thank you for all of the great suggestions! Tali Ash and I are excited to announce that our next webcast will be on November 17th. Be sure to join us for our new series l33tSpeak where we will share some of the latest Microsoft 365 Defender Advanced Hunting capabilities and provide demos based on your requests. We are looking forward to seeing everyone virtually again! To attend please register for our winter series of webcasts here: https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR_0A4IaJRDNBnp8pjCkWnwhUMjY1MERNU0FFUU9MN08yUFhaMUxNRDMxVi4uRe: How to Deal with Undetected Malware?
Hi Reza_Ameri-Archived , On DART, we used a lot of Microsoft Threat Protection \ Defender ATP custom detections paired with response actions to deal with this. Using this approach, you can isolate machines, block files by hash or certificate, run a quick scan, or collect a forensics package. What you're referring to falls more in line with hardening than preventing a 0-day. You can definitely use AppLocker to prevent malware, but it really depends on how it was set up. I'd recommend checking out AaronLocker - a config written by Aaron Margosis some time ago: https://github.com/Microsoft/AaronLocker. Other protections would be attack surface reduction (ASR) https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction, exploit protection (sort of like the new EMET) https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection, or Application Guard https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview. At the end of the day, what really makes an attack successful (in my opinion) is availability of credentials with widespread administrative authority. Keep tabs on delegations made on the root object of the domain (the domainDns object), user rights (especially on domain controllers), and permissions to the AdminSDHolder object. Its that whole assume breach mentality, and why many customers are moving towards Azure AD joined devices since it decouples identity from authorization, uses strong authentication, and decouples authentication from authorization. Check out the famous Pass the Hash whitepaper for those: https://aka.ms/pth Last, microservices are the way to go. Avoid having one huge monolithic infrastructure, instead favoring smaller containerized services which only have access to what they need to operate. The other place to keep an eye on is Defender ATP's threat and vulnerability management capability which can identify vulnerable applications, including which applications have an exploit in the wild. This paired with the Threat Analytics dashboard should keep you informed of many of the exploitation-centric threats to your infrastructure.Share Your Hunting Challenges!
Hello world! Tali Ash and I would love your input on anything you would like demo'ed in future webcasts! Want to see us demonstrate a specific hunting capability? Got a query challenge on your mind? Reply with your idea or like a reply from the community - we'll pick some of the popular ideas and put together future webcasts on the topics. Also, if you are looking for a great introduction to advanced hunting in MTP and KQL, be sure to check out our four part series Tracking the Adversary at http://aka.ms/securitywebinars, or download the query files to practice on your own MTP instance at https://aka.ms/TrackingTheAdversary. Happy hunting!Re: MDATP KQL Query isolated machines
Good morning agattsek , I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today. I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.
