[{"content":"On September 23, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, now in public preview.\nThere is already a LOT of content out there about ISOC. Announcements, docs, partner posts, hot takes… its easy to get lost. So I picked the 3 blogs that helped me most to really understand the new capabilities:\nIng. Derk van der Woude 🥷\n🔗 https://blue16.nl/isoc-explainer.html\nJoe S.\n🔗 https://www.patriotconsulting.com/blogs/2026/09/23/isoc-in-microsoft-defender-e5-e7-benefit\nNicola Suter\n🔗 https://nicolasuter.ch/microsoft-defender-isoc/\n💡 Good to know: the preview is currently for eligible Microsoft Defender Suite, Microsoft 365 E5 or E7 customers without an active Sentinel workspace.\n","permalink":"https://vertho.tech/2026/10/06/top3-blog-posts-about-microsoft-isoc/","summary":"\u003cp\u003eOn September 23, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, now in public preview.\u003c/p\u003e\n\u003cp\u003eThere is already a LOT of content out there about ISOC. Announcements, docs, partner posts, hot takes… its easy to get lost. So I picked the 3 blogs that helped me most to really understand the new capabilities:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIng. Derk van der Woude 🥷\u003c/strong\u003e\u003cbr\u003e\n🔗 \u003ca href=\"https://blue16.nl/isoc-explainer.html\" rel=\"noopener\"\u003ehttps://blue16.nl/isoc-explainer.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eJoe S.\u003c/strong\u003e\u003cbr\u003e\n🔗 \u003ca href=\"https://www.patriotconsulting.com/blogs/2026/09/23/isoc-in-microsoft-defender-e5-e7-benefit\" rel=\"noopener\"\u003ehttps://www.patriotconsulting.com/blogs/2026/09/23/isoc-in-microsoft-defender-e5-e7-benefit\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNicola Suter\u003c/strong\u003e\u003cbr\u003e\n🔗 \u003ca href=\"https://nicolasuter.ch/microsoft-defender-isoc/\" rel=\"noopener\"\u003ehttps://nicolasuter.ch/microsoft-defender-isoc/\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e💡 Good to know: the preview is currently for eligible Microsoft Defender Suite, Microsoft 365 E5 or E7 customers without an active Sentinel workspace.\u003c/p\u003e","title":"TOP3 blog posts about Microsoft ISOC"},{"content":"What is controlled Configuration Controlled configuration is a security management capability that enforces a single, authoritative source of truth for Microsoft Defender security settings on a device.\nControlled configuration covers both Microsoft Defender Antivirus and Attack Surface Reduction (ASR) settings, enforcing the cloud-managed policy state for these Defender security surfaces.\nWhen controlled configuration is turned on, your device automatically uses Microsoft Defender Antivirus’s default settings and disables local admin merge. If you’ve configured security settings through Intune or Microsoft Defender for Endpoint (MDE), those policies will take priority and override the defaults. Endpoint security settings configured by Group Policy, scripts, SCCM, and local admin actions are not honored when controlled configuration is turned on.\nThis feature is designed to address long‑standing customer pain around configuration drift, policy conflicts, and extended tamper protection coverage to additional endpoint security settings.\nKey benefits of controlled configuration include:\nAuthoritative AV Policy Enforcement: Intune and M365 Defender become the single source for AV configuration. No “shadow” policies from GPO or other tools will apply. This ensures features like real-time protection, scan schedules, signature updates, and exclusion lists configured in cloud policy are always active as intended. Improved Security Posture: By preventing configuration drift, controlled configuration helps maintain the secure settings your organization requires. It reduces the risk of inadvertent policy gaps (for example, an admin turning off an AV feature via local means). Simplified Troubleshooting: When only cloud policies are in effect, it’s easier to understand and audit why a device is in a given state. The effective configuration on devices is predictable, eliminating confusion from conflicting sources. Streamlined Future Expansion: The controlled configuration framework covers Microsoft Defender Antivirus and ASR settings and can be extended to other security policy areas, such as Device Control, to provide the same consistency there. This unified approach lays groundwork for holistic endpoint configuration management. Prerequisites Windows devices are onboarded to Microsoft Defender for Endpoint and the devices should have a Sense 9D version greater than 10.8804 Windows devices should have Microsoft Defender Antivirus platform version greater than 4.18.26060.3006. Use Get-MpComputerStatus to confirm the installed Defender version. If the device has an older Defender platform version, install version 4.18.26060.3008. Set the Defender platform update ring to Beta before updating Defender: Set-MpPreference -PlatformUpdatesChannel Beta. You can also update Defender using the platform update package: https://definitionupdates.microsoft.com/packages/content/updateplatform.exe?packageType=Platform\u0026packageVersion=4.18.26060.3008\u0026arch=x64 Endpoint security settings are managed via Intune or MDE Endpoint Security Setting (MDE Attach) Supported Devices, Environments and Defender Settings\nControlled configuration policy will only work on supported device SKUS, i.e. Win 11 or Win 10 or Windows Server 2019 Sever GCCH environments are not supported The following settings are not covered by controlled configuration:\nDevice Control EDR Firewall Controlled configuration setting overview The Windows \u0026gt; Windows Security Experience security template is the management surface used to enable controlled configuration. The current “Tamper protection” setting will be renamed and another drop-down option will be added for turning on controlled configuration, but controlled configuration enforcement applies to Microsoft Defender Antivirus and Attack Surface Reduction (ASR) settings.\nIn the table below, there is a mapping of the current windows tamper protection values and how they map to the new value names.\nOld Setting Name: “Tamper Protection (Device)”\nNew Setting Name: “Controlled configuration (Device)”\nSetting Values:\nCurrent Windows Tamper Protection Value New Value Name Setting Behavior Not configured Not configured Off Off Turns off controlled configuration and tamper protection On Tamper Protection (On) Turns on Tamper Protection and enforces the tamper protected settings to their Secure Defaults. (No change in behavior) Controlled configuration (On) Turns on controlled configuration, enforcing the configuration coming from Intune exclusively and any non-configured settings to their secure defaults. Tooltip description:\n“This setting can be used to turn on controlled configuration or tamper protection to help protect important security features from unwanted changes and interference.\nIf the setting is configured to Tamper Protection (On), this turns on tamper protection to enforce tamper protected settings to their secure defaults. This includes real-time protection, behavior monitoring, and more. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions.\nIf the setting is configured to Controlled configuration (On), this turns on controlled configuration, which enforces the configuration coming from Intune exclusively and any non-configured settings to their secure defaults. Controlled configuration is applicable to Microsoft Defender Antivirus and Attack Surface Reduction (ASR) settings.\nIf the setting is configured to OFF, this turns off controlled configuration and tamper protection.\nClearing tamper protection / controlled configuration state\nIn some testing or troubleshooting scenarios, you may need to clear the locally cached controlled configuration from a device after tamper protection has been enabled. This can help reset the device configuration state before reapplying policy.\nImportant: This procedure should only be used for troubleshooting, testing, or recovery scenarios. After clearing the controlled configuration state, the device may reapply configuration during the next policy sync.\nControlled configuration works with Microsoft Defender for Endpoint troubleshooting mode. When troubleshooting mode is enabled for a device, administrators can temporarily relax controlled configuration enforcement for troubleshooting and validation; when troubleshooting mode ends, the device returns to the configured controlled configuration policy state.\nPrerequisites\nTamper Protection enabled on the device Local administrator privileges Open an elevated Command Prompt and verify that the Microsoft Defender Antivirus service (WinDefend) is running. sc qc windefend\nExpected output:\nNavigate to the active Microsoft Defender platform folder. Note: The platform version folder may differ depending on the Defender build installed on the device Example: cd “C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26060.3004-0”\nRun the following command to clear the locally applied controlled configuration state: MpCmdRun.exe -Config -ResetControlledConfiguration\nafter enabling Troubleshooting Mode:\nAfter the command completes:\nIf the device is still targeted by Intune or MDE policy, controlled configuration and/or tamper protection settings may automatically reapply during the next policy refresh cycle\nThe locally cached controlled configuration is cleared\nDefender policy state may temporarily revert until the next policy sync\nControlled configuration defaults When controlled configuration is turned on, your device automatically uses Microsoft Defender Antivirus’s recommended default settings to help keep it protected. These defaults align with the settings protected by tamper protection and are designed to reflect Microsoft security best practices. Microsoft may update these default settings over time to reflect security best practices. If you’ve configured security settings through Intune or Microsoft Defender for Endpoint (MDE), those policies will continue to take priority and override the defaults as expected giving you full control over your configuration.\nOne exception is local administrator merge, which is automatically disabled when controlled configuration is enabled to ensure consistent and secure enforcement. This prevents locally defined settings, such as locally defined Defender antivirus exclusions, from weakening centrally managed security policies.\nWhen controlled configuration is enabled, settings that are not included in the list above can still be changed by both Defender and a local administrator using the PowerShell cmdlet set-MpPreference. For those settings, Defender behavior remains unchanged. However, controlled configuration does not read values from GP or MDM registry paths because those paths are not protected.\nThe Windows Security Experience template is only the management surface used to enable controlled configuration. Controlled configuration enforcement applies to Microsoft Defender Antivirus and Attack Surface Reduction (ASR) settings. Other Windows Security Experience settings, such as endpoint security settings under the Windows Defender Security Center, are not covered by controlled configuration.\nTamper protection and controlled configuration share the goal of preventing unauthorized changes to Microsoft Defender settings on Windows devices, but they differ significantly in scope, flexibility, and enforcement model. Tamper protection covers a small, fixed set of approximately 10–13 critical security settings—primarily the core protection toggles (real-time protection, behavior monitoring, cloud protection, IOAV scanning, script scanning, on-access protection, network protection, PUA protection) plus cloud block level, cloud extended timeout, and the exclusion merge behavior. It enforces only Microsoft-defined secure defaults and offers no customization: a setting is either locked to its safe value or it’s not protected at all.\nControlled configuration, by contrast, enforces the entire Defender security configuration surface that is cloud-manageable via Intune or MDE Endpoint Security policies. This means controlled configuration covers everything tamper protection covers plus the broader set of antivirus scan settings, scheduling, signature updates, exclusions, and is expanded to include Attack Surface Reduction rules.\nThe key distinction is that controlled configuration allows organizations to define their own desired state—not just Microsoft’s defaults—and makes cloud policy the single authoritative source, overriding all other configuration channels (GPO, SCCM, local admin, registry, PowerShell). In short, tamper protection locks a few critical switches to safe defaults; controlled configuration enforces the entire Defender configuration as defined by the organization’s cloud policy, making it a superset of tamper protection’s coverage with organizational customization.\nBelow is the complete list of what tamper protection covers. (The settings marked with * are also enforced by controlled configuration.)\nRegistry Value Default Value TP Behavior Summary Description DisableAntiVirus FALSE (0) Pref: Block changes. Policy: Ignore value (use default=0) and revert on TP enable. Enable/Disable use of AV signatures during a scan. FALSE means AV is enabled. DisableAntiSpyware FALSE (0) Pref: Block changes. Policy: Ignore value (use default=0) and revert on TP enable. Enable/Disable use of AS signatures during a scan. FALSE means anti-spyware is enabled. PassiveMode 0 (disabled) Block changes: prevents forcing Defender into passive mode. Controls side-by-side passive mode. 0=active (normal), non-zero=passive. Preference-only setting. DisableRoutinelyTakingAction FALSE (0) Pref: Block + use default + revert. Policy: Ignore value (use default=0). When FALSE, detected threats are automatically acted upon after ~10 min delay using the default action. DisableRealtimeMonitoring* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value (use default=0). No Revert in policy (UI-controlled). Turns off real-time protection prompts for known malware detection. FALSE = RTP enabled. DisableScanOnRealtimeEnable FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. Enables process scanning whenever realtime protection is turned on, to catch malware started while RTP was off. DisableOnAccessProtection* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, on-access protection is disabled. FALSE = on-access scanning enabled. DisableBehaviorMonitoring* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, behavior monitoring is disabled. FALSE = behavior monitoring enabled. DisableIOAVProtection* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, IOAV (downloads/attachments) protection is disabled. FALSE = IOAV enabled. DisableScriptScanning* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, AMSI file-less scan and legacy IE protection will be disabled. DisableIntrusionPreventionSystem FALSE (0) [inferred] Pref: Block + use default + revert. Policy: Ignore value. Obsolete If TRUE, network intrusion prevention system (IPS) is disabled. DisableEarlyLaunchAntimalware FALSE (0) [inferred] Pref: Block + use default + revert. Policy: Ignore value. Obsolete If TRUE, Early Launch Antimalware (ELAM) driver protection is disabled. DisableEnhancedNotifications FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, enhanced/detailed threat notifications are suppressed. DisableArchiveScanning* FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. If TRUE, scanning of archive files (ZIP, CAB, etc.) is disabled. ThreatSeverityDefaultAction\\1 remote_managed_default=2 (Clean) Pref: Block + use default + revert. Policy: Ignore value. Default action for Low severity threats. Action IDs: 2=Clean, 3=Quarantine, 6=Remove, 8=Allow, 9=UserDefined, 10=Block. ThreatSeverityDefaultAction\\2 remote_managed_default=2 (Clean) Pref: Block + use default + revert. Policy: Ignore value. Default action for Medium severity threats. ThreatSeverityDefaultAction\\4 remote_managed_default=2 (Clean) Pref: Block + use default + revert. Policy: Ignore value. Default action for High severity threats. ThreatSeverityDefaultAction\\5 remote_managed_default=2 (Clean) Pref: Block + use default + revert. Policy: Ignore value. Default action for Severe severity threats. DisablePrivacyMode FALSE (0) Pref: Use default + revert (no block). Policy: Ignore value. Controls privacy protection – whether non-admins can see detection history. Notification_Suppress FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. Suppresses all pop-up/toast notifications (including enhanced notifications). SuppressRebootNotification FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. Suppresses reboot notification in UI only. SuppressWdoNotification FALSE (0) Pref: Block + use default + revert. Policy: Ignore value. Suppresses Windows Defender Offline (WDO) notification in UI. SpyNetReporting 2 (Advanced/MAPS full) Pref: Block + use default (no revert, UI-controlled). Policy: Ignore value. Only active when Sense is running (E5). Cloud protection reporting level. 0=No participation, 1=Basic, 2=Advanced (send additional info including possible PII). DisableBlockAtFirstSeen FALSE (0) Pref: Block + use default (no revert). Policy: Ignore value. Only active when Sense running (E5). Disables the Block at First Seen (BAFS) cloud feature. FALSE = BAFS enabled. Note that this list does not include Tamper Protection specific setting defaults or which settings tamper protection blocks changes, but does not use default.\nEnableRemoteManagedDefaults is set to FALSE when controlled configuration is enabled. Generally, controlled configuration supports RemoteManagedDefault for settings that have not been configured yet, but in practice, the CX will not be able to use it.\nControlled configuration covers the Defender Antivirus and Attack Surface Reduction (ASR) settings from the Defender CSP and Defender Policy CSP, excluding device control settings. The default values applied by controlled configuration are listed below.\nSetting Name (CSP) Default Value (N/A means no default is enforced) ASROnlyPerRuleExclusions N/A (per-rule exclusion list) AllowArchiveScanning FALSE AllowBehaviorMonitoring FALSE AllowCloudProtection 2 AllowDatagramProcessingOnWinServer FALSE AllowEmailScanning TRUE AllowFullScanOnMappedNetworkDrives TRUE AllowFullScanRemovableDriveScanning TRUE AllowIOAVProtection FALSE AllowIntrusionPreventionSystem 1 (Allowed) [Deprecated] AllowNetworkProtectionDownLevel FALSE AllowNetworkProtectionOnWinServer FALSE AllowOnAccessProtection FALSE AllowRealtimeMonitoring FALSE AllowScanningNetworkFiles FALSE AllowScriptScanning FALSE AllowSwitchToAsyncInspection TRUE AllowUserUIAccess FALSE ArchiveMaxDepth 0 ArchiveMaxSize 0 AttackSurfaceReductionOnlyExclusions N/A (exclusion list) AttackSurfaceReductionRules N/A (list of rule GUIDs + actions) AvgCPULoadFactor 50 BehavioralNetworkBlocks N/A (container node) BruteForceProtection 0 BruteForceProtectionAggressiveness 0 BruteForceProtectionConfiguredState 0 BruteForceProtectionExclusions N/A (exclusion list) BruteForceProtectionLocalNetworkBlocking FALSE BruteForceProtectionMaxBlockTime 0 BruteForceProtectionPlugins N/A (plugin list) BruteForceProtectionSkipLearningPeriod FALSE CheckForSignaturesBeforeRunningScan FALSE CloudBlockLevel 0 (Default) CloudExtendedTimeout 0 (seconds) ControlledFolderAccessAllowedApplications N/A (application list) ControlledFolderAccessProtectedFolders N/A (folder list) DataDuplicationDirectory \\\\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data DataDuplicationLocalRetentionPeriod 60 DataDuplicationMaximumQuota 500 DataDuplicationRemoteLocation N/A (path string) DaysToRetainCleanedMalware 0 DaysUntilAggressiveCatchupQuickScan 30 DefaultEnforcement 1 DeviceControl N/A (container node) DeviceControlEnabled FALSE DisableCacheMaintenance 0 DisableCatchupFullScan TRUE DisableCatchupQuickScan TRUE DisableCoreServiceECSIntegration FALSE DisableCoreServiceTelemetry FALSE DisableCpuThrottleOnIdleScans 1 DisableDatagramProcessing FALSE DisableDnsOverTcpParsing FALSE DisableDnsParsing FALSE DisableFtpParsing FALSE DisableGradualRelease FALSE DisableHttpParsing FALSE DisableInboundConnectionFiltering FALSE DisableLocalAdminMerge FALSE DisableNetworkFileAccessTimeRestoration 0 DisableNetworkProtectionPerfTelemetry FALSE DisableQuicParsing TRUE DisableRdpParsing FALSE DisableSmtpParsing FALSE DisableSshParsing FALSE DisableTlsParsing FALSE EnableControlledFolderAccess 0 EnableConvertWarnToBlock FALSE EnableDnsSinkhole TRUE EnableFileHashComputation FALSE EnableLowCPUPriority FALSE EnableNetworkProtection 0 EnableUdpReceiveOffload FALSE EnableUdpSegmentationOffload FALSE EngineUpdatesChannel 0 ExcludedExtensions N/A (extension list) ExcludedIpAddresses N/A (IP list) ExcludedPaths N/A (path list) ExcludedProcesses N/A (process list) HideExclusionsFromLocalAdmins FALSE HideExclusionsFromLocalUsers TRUE IntelTDTEnabled 0 (Disabled) MeteredConnectionUpdates 0 NetworkProtectionReputationMode 0 OobeEnableRtpAndSigUpdate 0 PUAProtection 0 PassiveRemediation 0 PerformanceModeStatus 0 PlatformUpdatesChannel 0 QuickScanIncludeExclusions 0 RandomizeScheduleTaskTimes 1 RealTimeScanDirection 0 RemoteEncryptionProtection 0 RemoteEncryptionProtectionAggressiveness 0 RemoteEncryptionProtectionConfiguredState 0 RemoteEncryptionProtectionExclusions N/A (exclusion list) RemoteEncryptionProtectionMaxBlockTime 0 Reporting N/A (container node) ScanOnlyIfIdleEnabled TRUE ScanParameter 1 ScheduleQuickScanTime 0 ScheduleScanDay 0 ScheduleScanTime 0x78 ScheduleSecurityIntelligenceUpdateDay 8 ScheduleSecurityIntelligenceUpdateTime 0x69 SchedulerRandomizationTime 4 SecuredDevicesConfiguration N/A (configuration string) SecurityIntelligenceLocation N/A (path string) SecurityIntelligenceLocationUpdateAtSchedu FALSE SecurityIntelligenceLocationUpdateAtScheduledTimeOnly FALSE SecurityIntelligenceUpdatesChannel 0 SignatureUpdateFallbackOrder MicrosoftUpdateServer SignatureUpdateFileSharesSources N/A (UNC path list) SignatureUpdateInterval 0 SubmitSamplesConsent 0 SupportLogLocation N/A (path string) TamperProtection 0 ThreatSeverityDefaultAction 2 ThrottleForScheduledScanOnly TRUE Intune Policy Conflicts Controlled configuration uses a deterministic “controlled configuration ON wins” precedence model. It does not use first-write-wins, last-write-wins, or policy-ID priority. When conflicting policies target the same device, the device enforcement state is calculated based on the policy values themselves.\nThe controlled configuration ON value takes precedence for device enforcement over controlled configuration OFF. The controlled configuration ON value takes precedence for device enforcement when controlled configuration ON and tamper protection ON are both targeted to the same device. Matching values report as Success in Intune; mixed values report as Conflict. This is value-based precedence only; policy creation time, delivery order, or policy ID does not determine the final device state. ⚠️ Important: Avoid creating overlapping policies with different controlled configuration values. Although device enforcement is deterministic and the controlled configuration ON value takes precedence for device enforcement, Intune will still surface the overlap as a policy conflict.\nScenario Device result Intune reporting Controlled configuration ON + controlled configuration OFF Controlled configuration ON Conflict Controlled configuration ON + tamper protection ON Controlled configuration ON enforced; tamper protection may still appear ON in reporting Conflict Controlled configuration ON + controlled configuration ON Controlled configuration ON Success Controlled configuration OFF + controlled configuration OFF Controlled configuration OFF Success Multiple policies with mixed ON/OFF values Controlled configuration ON Conflict Conflict Scenarios\nUnderstanding how conflicts are reported is critical to managing controlled configuration effectively:\nScenario: controlled configuration ON + TP ON on the same device If Policy 1 sets TP = ON and Policy 2 sets controlled configuration = ON, the controlled configuration ON value takes precedence for device enforcement. Intune reports the overlap as Conflict. Tamper protection may still appear as ON in reporting even though controlled configuration ON is the enforced device state. Scenario: Same value, no conflict If Policy 1 and Policy 2 both set controlled configuration = ON (or both set OFF), the setting reports as Success — no conflict. Scenario: Three or more policies When three or more policies with different controlled configuration values target the same device, the controlled configuration ON value takes precedence for device enforcement and Intune reports the conflicting settings as Conflict. Best Practice: Target each device with a single controlled configuration policy to avoid conflicts and ensure predictable behavior.\nControlled configuration State You can verify the controlled configuration state on devices through the following methods:\nControlled configuration state in the registry on the device Effective Settings report in Microsoft Defender for Endpoint Setting Policy Report in Intune / MDE Controlled configuration state in the Antivirus report in Intun Unassignment and Unenrollment behavior Policy Unassignment (Removing or deleting a policy)\nControlled configuration is not tattooed on the device. When a policy is unassigned or deleted:\nThe controlled configuration value from that policy is removed from the device. If other policies still target the device, the next applicable policy takes effect. If no policies remain, controlled configuration reverts to OFF. Scenario Result Controlled configuration ON policy unassigned; no other policies remain Controlled configuration = OFF Controlled configuration ON policy unassigned; another controlled configuration ON policy exists Controlled configuration = ON (next policy applies) Controlled configuration ON policy unassigned; OFF policy remains Controlled configuration = OFF ⚠️ “Not Configured” Does Not Equal “Off”:\nUnassigning a policy or setting it to “Not Configured” does not remove an existing controlled configuration state by itself. If controlled configuration was applied by another targeted policy, that policy continues to determine the device state; if no controlled configuration policies remain, controlled configuration is removed and the device reverts to OFF.\nUnenrollment from MDE (device unenrolled, not offboarded)\nIf a device is unenrolled from MDE while a controlled configuration ON policy is targeted, controlled configuration remains ON on the device. Unenrollment does not clean up the controlled configuration state in Defender Antivirus. Intune reports the setting as No longer applicable. Offboarding from MDE\nIf a device is offboarded from MDE, the controlled configuration hive is cleaned up and controlled configuration reverts to OFF. This is the expected cleanup path for devices leaving the MDE service entirely. Action Controlled configuration state Policy unassigned (no other policies) Controlled configuration = OFF Device unenrolled from MDE Controlled configuration = ON (not cleaned up) Device offboarded from MDE Controlled configuration = OFF (cleaned up) Reporting Intune policy reports Intune will reflect the standard set of policy reports for the Windows Security Experience policy template (contains setting to turn on controlled configuration) and policy templates that are supported by controlled configuration, including Antivirus and Attack Surface Reduction (ASR). This includes the device and user check-in status, per setting status, and device level reports.\n*Select policy \u0026gt; Per setting status report\nFor the Windows Security Experience policy template, the per setting status report will reflect the success status for tamper protection and controlled configuration with the following:\nMDM devices:\n“Tamper Protection Blob” –\u0026gt; MDE attach devices:\n“Tamper Protection Blob” –\u0026gt; “Controlled configuration blob” –\u0026gt; “Controlled configuration (Device)” –\u0026gt; will be with the success status, as shown below.\n*Select device \u0026gt; Device configuration report\nWhen selecting a given device in Intune or Defender, the list of policies applied to the device will show the related controlled configuration ones. Selecting this policy applied to the device will surface the state of controlled configuration applied to the device if it is Success, Error or Conflict.\nAntivirus reports Within the Unhealthy endpoints (Endpoint security \u0026gt; Antivirus \u0026gt; Unhealthy endpoints) and Antivirus agent status (Reports \u0026gt; Antivirus \u0026gt; Antivirus agent status) reports in Intune, the “Controlled configuration” column and values will reflect the state of MDM devices with controlled configuration being Enabled or Disabled. Note, MDE attach devices are not in scope of these reports.\nSource:\nPrivate Preview – Defender Controlled Configuration Limited Preview\nControlled configuration in Microsoft Defender for Endpoint – Microsoft Defender for Endpoint | Microsoft Learn\n","permalink":"https://vertho.tech/2026/08/13/defedner-for-endpoint-controlled-configuration-tamper-protection-on-steroids-a-deep-dive/","summary":"\u003ch2 id=\"what-is-controlled-configuration\"\u003eWhat is controlled Configuration\u003c/h2\u003e\n\u003cp\u003eControlled configuration is a security management capability that enforces \u003cstrong\u003ea single, authoritative source of truth\u003c/strong\u003e for Microsoft Defender security settings on a device.\u003c/p\u003e\n\u003cp\u003eControlled configuration covers both Microsoft Defender Antivirus and Attack Surface Reduction (ASR) settings, enforcing the cloud-managed policy state for these Defender security surfaces.\u003c/p\u003e\n\u003cp\u003eWhen controlled configuration is turned on, your device automatically uses Microsoft Defender Antivirus’s default settings \u003cstrong\u003eand disables local admin\u003c/strong\u003e \u003cstrong\u003emerge\u003c/strong\u003e. \u003cstrong\u003eIf you’ve configured security settings through Intune or Microsoft Defender for Endpoint (MDE), those policies will take priority and override the defaults.\u003c/strong\u003e Endpoint security settings configured by Group Policy, scripts, SCCM, and local admin actions are not honored when controlled configuration is turned on.\u003c/p\u003e","title":"Defender for Endpoint Controlled configuration, Tamper protection on steroids:  A deep dive"},{"content":" ⚠️ This tool has been retired and is no longer available. The screenshots below are kept for reference.\nI created a web based interactive Microsoft Defender Unified RBAC permissions mapper to make your life easier when you need to exactly find which permissions you need for Defender. It consist out of key capabilities and applicable workloads based on the docs.\n","permalink":"https://vertho.tech/2026/03/23/microsoft-defender-unified-role-based-access-mapper/","summary":"\u003cblockquote\u003e\n\u003cp\u003e⚠️ \u003cstrong\u003eThis tool has been retired\u003c/strong\u003e and is no longer available. The screenshots below are kept for reference.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eI created a web based interactive Microsoft Defender Unified RBAC permissions mapper to make your life easier when you need to exactly find which permissions you need for Defender. It consist out of key capabilities and applicable workloads based on the docs.\u003c/p\u003e\n\u003cp\u003e\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2026/03/23/microsoft-defender-unified-role-based-access-mapper/image-6.png\"\u003e\n\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2026/03/23/microsoft-defender-unified-role-based-access-mapper/image-7.png\"\u003e\u003c/p\u003e","title":"Microsoft Defender Unified Role based access mapper"},{"content":"Intro During my latest engagements with different customers I frequently received the question why you still have to configure Azure permissions if you want to use the unified portal experience in Defender to access log analytics workspace log data. I can finally say this isn’t the case anymore, Microsoft recently announced that Unified RBAC supports Sentinel permissions in the Defender Portal. I tested it out already and will share some limitations and tricks and tips!\nWhat’s new: Defender Unified RBAC for Sentinel Sentinel permissions in the Defender Portal: Sentinel permissions can now be managed directly in the Microsoft Defender portal without the need to switch to the Azure portal for access management. This includes data lake support. Unified Permissions Model: Manage user privileges for Sentinel and other Defender workloads in a single, consistent system. Future-Proof Scoping: Assignments can automatically include future data sources and workspaces as they’re added. Prerequisites Access to the Microsoft Defender portal: Ensure you can sign in at https://security.microsoft.com. Global Administrator or Security Administrator role and Unified RBAC enabled: For more details, see Manage RBAC in Defender XDR. Sentinel workspaces onboarded to Defender portal: Sentinel workspaces must be available in the Defender portal before roles and permissions can be assigned. Important notes Azure: Once URBAC is activated for Sentinel, URBAC should be used to manage Sentinel permissions (as opposed to the Azure portal). Making permission changes in Azure once URBAC is active may lead to sync-errors. If this happens, you will see a notification on the Permissions page, with instructions on how to resolve this In URBAC, being a Global Administrator does not grant you automatic permissions over workspaces. It does grant you the right to assign permissions, including to yourself Sentinel experiences in the Defender portal continue to respect ARM roles and permissions in addition to URBAC. Therefore, users with more permissions in ARM than in URBAC may see more data in the Sentinel pages in the Defender portal than configured in their URBAC permissions Limitations Not supported: the Microsoft Sentinel Playbook Operator, Automation Contributor and Workbook Contributor role. These continue to be managed in Azure for the moment. Not yet supported: importing existing roles and assignments from Azure Sentinel for easy migration. This is planned to be introduced soon. Permissions are set at the workspace level. More granular (row-level) scoped access control is under development; to be introduced in a separate preview. Instructions Create a Custom Role Go to the Permissions page in Defender, and select ‘Defender XDR’ -\u0026gt; ‘Roles’\nIn the Roles page, click Create a custom role.\nEnter a role name and description.\nSelect the required permissions using this mapping table:\nSentinel Role Unified RBAC Permissions Microsoft Sentinel Reader Security operations / Security data basic (read) Microsoft Sentinel Responder Security operations / Security data basic (read) Security operations / Alerts (manage) Security operations / Response (manage) Microsoft Sentinel Contributor Security operations / Security data basic (read) Security operations / Alerts (manage) Security operations / Response (manage) Authorization and settings / Detection tuning (manage) Click Next. Click Add assignment. Name the assignment. Select users and/or groups. Choose the Sentinel workspaces for the assignment. (Optional) Enable “Include future data sources automatically.” Click Submit. Activate Unified RBAC for Sentinel Go back to the Roles page Click on ‘Activate workloads’ button in the top Click on ‘Manage workspaces’ Select the desired workspaces to enable URBAC on Click ‘Activate workspaces’ Edit, Delete, or Export Roles To edit: Select the role, click Edit, and update as needed. To delete: Select the role and click Delete. To export: Click Export to download a CSV of roles, permissions, and assignments Frequently asked questions What happens to legacy Sentinel roles after activating Unified RBAC?\nURBAC becomes the primary source of your permissions for Sentinel. While you can still manage permissions in Azure, doing so may create sync issues with URBAC. Once URBAC is activated for a Sentinel workspace, continue to manage your permissions in URBAC.\nCan I revert to managing Sentinel roles in Azure after enabling Unified RBAC?\nYes, you can deactivate Unified RBAC for Sentinel in the Defender portal’s workload settings. This will revert to legacy Sentinel roles and their associated access controls.\nHow granular is access control in Unified RBAC for Sentinel (workspace, row-level, etc.)?\nCurrently, permissions are set at the workspace level. More granular (row-level) scoped access control is under development.\nAre there any limitations or unsupported features in the current preview?\nThe Microsoft Sentinel Playbook Operator and Automation Contributor roles are not yet supported in URBAC; these continue to be managed in Azure for now.\nDoes Unified RBAC support both Sentinel Analytics and Lake workspaces?\nYes, Unified RBAC supports both Sentinel Analytics and Lake workspaces for consistent access management.\nSource: Microsoft Sentinel is now supported in Unified RBAC with row-level access | Microsoft Community Hub\n","permalink":"https://vertho.tech/2026/03/22/defender-unified-role-based-access-control-rbac-support-for-microsoft-sentinel-is-here-tool-urbac-mapper/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eDuring my \u003cstrong\u003elatest\u003c/strong\u003e engagements with different \u003cstrong\u003ecustomers\u003c/strong\u003e I frequently received the question why you still have to configure Azure permissions if you want to use the unified portal experience in Defender to access log analytics workspace log data. I can finally say this isn’t the case anymore, Microsoft recently announced that Unified RBAC supports Sentinel permissions in the Defender Portal. I tested it \u003cstrong\u003eout\u003c/strong\u003e already and will share some limitations and \u003cstrong\u003etricks\u003c/strong\u003e and tips!\u003c/p\u003e","title":"Defender Unified Role-Based Access Control (RBAC) support for Microsoft Sentinel is here"},{"content":"Intro This blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a valuable setting for security teams who want to see all user identities across the organization in one unified view.\nℹ️ This blogpost is updated on 11/05/2026:\n– Create custom account correlation rules\n– Example of response actions on unified accounts\n– Monitor automatic Account correlation\nScattered Identities In corporate settings, user identities tend to be scattered across multiple platforms. One person may hold several different accounts personal, admin-level, outdated, cloud-hosted, or abandoned spread across systems like on-premises Active Directory, Microsoft Entra ID, or third-party identity providers such as Okta.\nThis scattered landscape makes it hard to get a complete picture of who’s who across the organization. By manually connecting or disconnecting related accounts in Microsoft Defender for Identity, you can:\nBring together identity data from different systems. Strengthen security by building a fuller understanding of each user’s identity. Streamline investigations and incident response through a consolidated view of user identities. For example:\nPersonal and privileged accounts: A user might have two accounts, one for everyday work and another with elevated permissions for administrative tasks. For example:\nthomas@meatsweater.be (regular account)\nadmin-thomas@meatsweater.be (privileged account) Multiple domains: Large organizations often manage several domains. Linking accounts across these domains provides full visibility into a user’s activity. For example:\nthomas@meatsweater.be\nthomas@phishsweater.be Personal and service accounts: A user might have both a personal account and a service account they own or manage. Linking those accounts helps connect ownership and responsibility to the same identity. For example:\nthomas@meatsweater.be\nbackup.service@meatsweater.be Accounts in multiple services: A user might have a Microsoft Entra ID account, an Okta account, and a Ping account. Manually linking these accounts to the user’s identity creates a consolidated view that supports identity-centric protection and investigation. Legacy accounts: A user might still have an active account in a legacy system. Linking accounts ensures the legacy account is monitored and tied back to the correct identity. For example:\nthomas@meatsweater.be\nthomas@meatsweater.local Use the procedures in this article to manually link accounts to identities, and to manually unlink unused, legacy, or orphaned accounts from identities in Defender for Identity.\nManually link accounts to an identity in Defender for Identity In the Microsoft Defender portal at https://security.microsoft.com, go to Assets \u0026gt; Identities. Or, to go directly to the Identity Inventory page, use https://security.microsoft.com/identity-inventory.\nOn the Identities tab of the Identity Inventory page, select an identity from the list by clicking on the Display name value.\nOn the identity details page that opens, select the Observed in organization tab, and verify the Accounts tab is selected.\nOn the Accounts tab, select Link.\nThe Link accounts wizard opens. On the Select accounts page, use the search box to find an account. You can search by Display name, User principal name (UPN), Security identifier (SID), Source provider account\nSelect one account by selecting the check box next to the Display name column, and then select Next.\nOn the Enter justification page, enter a short explanation why you’re linking these accounts. A valid explanation includes:\nAfter the account is successfully linked, select Done\nUnlinking Accounts If you are not happy with the result or you want to unlink accounts again , you can follow those steps:\nOn the Identities tab of the Identity Inventory page at https://security.microsoft.com/identity-inventory, select an Identity from the list by clicking on the Display name value.\nOn the identity details page that opens, select the Observed in organization tab, and verify the Accounts tab is selected.\nOn the Accounts tab, select the account you want to unlink from the identity by selecting the check box next to the Display name column, and then select Unlink.\nExample of response actions on unified accounts Below is an example of the benefit of this new capability. When a SOC analyst wants to disable a compromised account he will get the following screen. Telling that there is another account linked to this account and with the question if you want to disable this linked account too.\nCreate custom account correlation rules There is a new capability called ‘Custom account correlation rules’ which help you with automating the linking of accounts. Custom account correlation rules allow you to correlate accounts that don’t share strong identifiers such as account ID, SID, object ID, or UPN. This is especially useful for privileged accounts with unique naming conventions. The following correlation types are available:\nCorrelation type Description Example Root UPN Prefix Correlates accounts with matching prefixes before the ‘@’ symbol. user@acme.com and adm_user@acme.com share the prefix user. Root UPN Suffix Correlates accounts with matching suffixes after the ‘@’ symbol. user@acme.com and user_svc@acme.com share the suffix @acme.com. Domain UPN Correlates accounts across different domains with the same username. user@acme.com and user@contoso.com. Employee ID Correlates accounts that share the same employee ID. Two accounts with the same employee ID value are linked to one identity. ⛔ 11/05/2026 Employee ID is currently not available in the GUI of defender. This is reported to Microsoft and currently no update about it. Maybe its a capability that comes available in the next stage!\nAdd a correlation rule In the Microsoft Defender portal at https://security.microsoft.com, go to Settings \u0026gt; Identities.\nSelect Account Correlation Rules.\nSelect Add Rule.\nIn the wizard, enter a Rule Name (up to 50 characters). You can use letters, numbers, and the following special characters: . - _ ! # ^ ~.\nSelect the Correlation Type (Root UPN Prefix, Root UPN Suffix, Domain UPN, or Employee ID).\nEnter the required values for the selected correlation type, such as prefixes, suffixes, domains, or employee\nIDs.Review the summary, which includes the rule name, correlation type, and selected values.\nSelect Submit to create the rule. Correlation rule changes take effect within 12 hours.\nMonitor automatic Account correlation Out of the box you don’t get insights on what correlation are happing in the background. That’s why i started digging into the different XDR tables.\nI quickly found that in the IdentityAccountInfo there is new field called ‘IdentityLinkType’. Which had 3 values in my (test) environment:\nStrongID Manual PolicyBased I think the names speak for them self but espcially the Manual and PolicyBased where interesting for me.\nWhen you have a look at the PolicyBased logs, you noticed that you also have IdentityLinkReason that you can use to validate which rules caused the correlation. Idem for the IdentityLinkBy which is System.\nAnother interesting value is the:\nIdentityId string Identifier for the identity that the account is linked to this value is also available in the IdentityInfo table. If we combine those together we can get all identities that are Linked to each other by policy or manual:\nIdentityInfo | join kind=inner IdentityAccountInfo on IdentityId | where IdentityLinkType == \u0026#34;PolicyBased\u0026#34; or IdentityLinkType == \u0026#34;Manual\u0026#34; | extend OriginalAccount = AccountUpn | extend LinkedAccountTo = AccountUpn1 | distinct OriginalAccount, LinkedAccountTo, IdentityLinkType If you run this the result is:\nNow you have a nice overview of all the account which are linked to each other!\n","permalink":"https://vertho.tech/2026/02/11/identity-threat-detection-and-response-linking-accounts/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eThis blog post covers a Defender for Identity feature that hasn’t received much attention. Despite flying under the radar, it’s a valuable setting for security teams who want to see all user identities across the organization in one unified view.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eℹ️ This blogpost is updated on 11/05/2026:\u003cbr\u003e\n– Create custom account correlation rules\u003cbr\u003e\n– Example of response actions on unified accounts\u003cbr\u003e\n– Monitor automatic Account correlation\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"scattered-identities\"\u003eScattered Identities\u003c/h2\u003e\n\u003cp\u003eIn corporate settings, user identities tend to be scattered across multiple platforms. One person may hold several different accounts personal, admin-level, outdated, cloud-hosted, or abandoned spread across systems like on-premises Active Directory, Microsoft Entra ID, or third-party identity providers such as Okta.\u003c/p\u003e","title":"Identity threat detection and response: Linking accounts"},{"content":"Intro I recently assisted a costumer with migrating to Defender for Endpoint. They had some windows 10/11 endpoints where the 3rd party Antivirus (AV) kept registered as primary Antivirus which by default put Defender for Endpoint in disable state on Windows 10/11:\nTogether with the Internal system engineers we tested multiple uninstall packages/scripts provided by the vendor or suggestions we found on various forums, we even tested the uninstall scripts in safe mode as a test, but still this 3rd party AV stayed registered until…\nWindows internals: Third-party AV Registration I decided to dive into the Windows internals documentation to understand the issue better. Windows Security Center (WSC) is responsible for monitoring the health and status of security products like antivirus, firewall, and antispyware. When a third-party AV is installed, it must register with WSC to be recognized as the active protection provider.\nIf registration is successful, Microsoft Defender Antivirus will automatically switch to passive or disabled mode to avoid conflicts, only on Windows 10/11. If registration fails, Defender remains active, potentially causing dual AV conflicts. Some tools (e.g., no-defender, defendnot) exploit undocumented WSC API behavior to falsely register as AVs, causing Defender to disable itself. I high suggest to read the following article about this: Windows Security Center API | es3n1n/no-defender | DeepWiki\nStarting with newer builds of Windows 10 and continuing in Windows 11, WSC requires that third-party AV software runs as a protected process to be registered. You can check this with procexp from sysinternals.\nThis is enforced via the Protected Process Light (PPL) mechanism. AVs must be signed and meet integrity checks (e.g., IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRIT flag in the PE header). The Windows Security Center API is a Windows interface that lets security software (like antivirus programs) register themselves with Windows and allows applications to query what security products are installed on a system.\nDetection of 3rd party registration There are alot of different ways you can validate which Antivirus solution is registered. In my case I check it first in the registry. You can find that information under HKLM\\software\\Microsoft\\Security Center\\Provider\\AV{GUID}\nI suggest you remember the GUID being used here because later on we are going to use it to delete the registered 3rd party AV solution.\nWMI can be used to query registered AV products via:\nwmic /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName Note: I read in an article that Windows server editions may not support this namespace.\nDelete the registered 3rd party AV I started first manually testing it with a tool called WBEMTest . WBEMTest is a built-in Windows tool used to interact with WMI (Windows Management Instrumentation). It’s like a low-level browser for WMI, allowing you to:\nConnect to WMI namespaces Query WMI classes and instances View and edit properties Create or delete WMI objects It’s mostly used by IT pros and developers for debugging, testing, and manual inspection of WMI data.\nRegistered antivirus products are stored in the WMI namespace:\nroot\\SecurityCenter2 and the class:\nAntiVirusProduct Here’s a step-by-step guide:\nOpen WBEMTest Press Win + R, type wbemtest, and hit Enter. Connect to Namespace Click Connect… Enter: root\\SecurityCenter2 Click Connect Query Antivirus Products Click Query… Enter: SELECT * FROM AntiVirusProduct Click Apply View Instances You’ll see a list of registered AV products. Double-click one to inspect its properties. Delete an Entry In the instance window, click Delete. Confirm deletion. ⚠️ Deleting AV entries from WMI does not uninstall the antivirus. It only removes its registration from Windows Security Center. This can cause Defender to re-enable itself or lead to inconsistent system behavior.\nIf you want to have an automated way so you can push a script on mass, you can use the following script i created:\n# Run this script as Administrator $targetName = \u0026#34;Kaspersky\u0026#34; # Change this to match the AV name you want to remove $namespace = \u0026#34;root\\SecurityCenter2\u0026#34; $class = \u0026#34;AntiVirusProduct\u0026#34; $logPath = \u0026#34;$env:USERPROFILE\\Desktop\\AV_Unregister_Specific_Log.txt\u0026#34; # Create or clear the log file New-Item -Path $logPath -ItemType File -Force | Out-Null Add-Content -Path $logPath -Value \u0026#34;[$(Get-Date)] Starting targeted AV unregistration script.`n\u0026#34; try { $avProducts = Get-WmiObject -Namespace $namespace -Class $class | Where-Object { $_.displayName -like \u0026#34;*$targetName*\u0026#34; } if ($avProducts.Count -eq 0) { Add-Content -Path $logPath -Value \u0026#34;[$(Get-Date)] No antivirus products found matching: $targetName\u0026#34; } else { foreach ($product in $avProducts) { $name = $product.displayName Add-Content -Path $logPath -Value \u0026#34;[$(Get-Date)] Deleting: $name\u0026#34; $product.Delete() } Add-Content -Path $logPath -Value \u0026#34;[$(Get-Date)] Completed deletion of matching AV entries.\u0026#34; } } catch { Add-Content -Path $logPath -Value \u0026#34;[$(Get-Date)] ERROR: $_\u0026#34; } Write-Host \u0026#34;Operation complete. Log saved to: $logPath\u0026#34; Script can also be found on my Github: Defender-for-endpoint/Delete Specific AV by Name .ps1 at main · v3rtho/Defender-for-endpoint\nThat’s it. Normally no 3rd party AV will be registered now and Defender AV will get in active mode!\n","permalink":"https://vertho.tech/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eI recently assisted a costumer with migrating to Defender for Endpoint. They had some windows 10/11 endpoints where the 3rd party Antivirus (AV) kept registered as primary Antivirus which by default put Defender for Endpoint in disable state on Windows 10/11:\u003c/p\u003e\n\u003cp\u003e\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/image-1.png\"\u003e\u003c/p\u003e\n\u003cp\u003eTogether with the Internal system engineers we tested multiple uninstall packages/scripts provided by the vendor or suggestions we found on various forums, we even tested the uninstall scripts in safe mode as a test, but still this 3rd party AV stayed registered until…\u003c/p\u003e","title":"Defender for Endpoint Migration: Troubleshooting Persistent Third-Party AV Registration"},{"content":"A user-friendly graphical interface for managing Microsoft Defender for Identity (MDI) configurations using PowerShell.\nThis PowerShell script provides a comprehensive WPF-based GUI wrapper around the Microsoft Defender for Identity PowerShell module. It simplifies the configuration, testing, and management of MDI deployments through an intuitive interface, eliminating the need to remember complex PowerShell commands.\nDownload: v3rtho/MDI-configurator: Guidance scripts related to Defender For Identity: Prereqs, configuration etc\nFeatures 🔧 Configuration Management Set MDI configurations for Domain or LocalMachine mode All (all configurations) AdfsAuditing AdRecycleBin AdvancedAuditPolicyCAs AdvancedAuditPolicyDCs CAAuditing ConfigurationContainerAuditing EntraConnectAuditing RemoteSAM DomainObjectAuditing NTLMAuditing ProcessorPerformance 🧪 Testing \u0026amp; Validation Test MDI configurations Validate specific audit policies Support for both Domain and LocalMachine testing modes 📊 Reporting Generate comprehensive HTML configuration reports Customizable output path Automatic report opening option Domain and LocalMachine report modes 🌐 Proxy Configuration Configure MDI sensor proxy settings Support for authenticated proxies Get current proxy configuration Clear proxy settings Test sensor API connectivity 👤 Directory Service Account (DSA) Management Create DSA accounts Test DSA permissions and delegations View current MDI configuration 🚀 Prerequisites Operating System: Windows 10/11 or Windows Server 2016+ PowerShell: Version 5.1 or later Module: DefenderForIdentity PowerShell module Permissions: Administrator rights required for most operations 📦 Installation 1. Install the DefenderForIdentity Module Open PowerShell as Administrator and run:\nInstall-Module -Name DefenderForIdentity -Force 2. Download the Script Clone this repository or download the MDI-configurator.ps1\n3. Execution Policy Ensure your PowerShell execution policy allows script execution:\nSet-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser 🎯 Usage Running the Script Option 1: From PowerShell .\\MDI-configurator.ps1 First-Time Setup The script will automatically check if the DefenderForIdentity module is installed If not found, it will prompt you with installation instructions After installing the module, restart the application ","permalink":"https://vertho.tech/2025/12/01/mdi-configurator-v1-0-is-out/","summary":"\u003cp\u003eA user-friendly graphical interface for managing Microsoft Defender for Identity (MDI) configurations using PowerShell.\u003c/p\u003e\n\u003cp\u003eThis PowerShell script provides a comprehensive WPF-based GUI wrapper around the Microsoft Defender for Identity PowerShell module. It simplifies the configuration, testing, and management of MDI deployments through an intuitive interface, eliminating the need to remember complex PowerShell commands.\u003c/p\u003e\n\u003cp\u003eDownload: \u003ca href=\"https://github.com/v3rtho/MDI-configurator\" rel=\"noopener\"\u003ev3rtho/MDI-configurator: Guidance scripts related to Defender For Identity: Prereqs, configuration etc\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"features\"\u003eFeatures\u003c/h2\u003e\n\u003ch3 id=\"-configuration-management\"\u003e🔧 Configuration Management\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSet MDI configurations for Domain or LocalMachine mode\u003c/li\u003e\n\u003cli\u003eAll (all configurations)\u003c/li\u003e\n\u003cli\u003eAdfsAuditing\u003c/li\u003e\n\u003cli\u003eAdRecycleBin\u003c/li\u003e\n\u003cli\u003eAdvancedAuditPolicyCAs\u003c/li\u003e\n\u003cli\u003eAdvancedAuditPolicyDCs\u003c/li\u003e\n\u003cli\u003eCAAuditing\u003c/li\u003e\n\u003cli\u003eConfigurationContainerAuditing\u003c/li\u003e\n\u003cli\u003eEntraConnectAuditing\u003c/li\u003e\n\u003cli\u003eRemoteSAM\u003c/li\u003e\n\u003cli\u003eDomainObjectAuditing\u003c/li\u003e\n\u003cli\u003eNTLMAuditing\u003c/li\u003e\n\u003cli\u003eProcessorPerformance\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"-testing--validation\"\u003e🧪 Testing \u0026amp; Validation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eTest MDI configurations\u003c/li\u003e\n\u003cli\u003eValidate specific audit policies\u003c/li\u003e\n\u003cli\u003eSupport for both Domain and LocalMachine testing modes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"-reporting\"\u003e📊 Reporting\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eGenerate comprehensive HTML configuration reports\u003c/li\u003e\n\u003cli\u003eCustomizable output path\u003c/li\u003e\n\u003cli\u003eAutomatic report opening option\u003c/li\u003e\n\u003cli\u003eDomain and LocalMachine report modes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"-proxy-configuration\"\u003e🌐 Proxy Configuration\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eConfigure MDI sensor proxy settings\u003c/li\u003e\n\u003cli\u003eSupport for authenticated proxies\u003c/li\u003e\n\u003cli\u003eGet current proxy configuration\u003c/li\u003e\n\u003cli\u003eClear proxy settings\u003c/li\u003e\n\u003cli\u003eTest sensor API connectivity\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"-directory-service-account-dsa-management\"\u003e👤 Directory Service Account (DSA) Management\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCreate DSA accounts\u003c/li\u003e\n\u003cli\u003eTest DSA permissions and delegations\u003c/li\u003e\n\u003cli\u003eView current MDI configuration\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"-prerequisites\"\u003e🚀 Prerequisites\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eOperating System:\u003c/strong\u003e Windows 10/11 or Windows Server 2016+\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePowerShell:\u003c/strong\u003e Version 5.1 or later\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eModule:\u003c/strong\u003e DefenderForIdentity PowerShell module\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePermissions:\u003c/strong\u003e Administrator rights required for most operations\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"-installation\"\u003e📦 Installation\u003c/h2\u003e\n\u003ch3 id=\"1-install-the-defenderforidentity-module\"\u003e1. Install the DefenderForIdentity Module\u003c/h3\u003e\n\u003cp\u003eOpen PowerShell as Administrator and run:\u003c/p\u003e","title":"MDI-configurator v1.0 is out !"},{"content":"Intro Microsoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about possible use cases for this new feature. Together with Bjorn Claes, we explored whether it’s possible to exclude the Intune wipe process from isolation mode. If this works, it would allow us to remotely wipe devices using Intune while keeping them in isolation mode within Defender for Endpoint.\nA special thanks to Rudy Ooms for his Intune Insights blogs, which helped us quickly identify the processes and services we needed to investigate. His blogs can you find here.\nWhat’s new Isolation exclusions allow designated processes or endpoints to bypass the restrictions of network isolation, ensuring essential functions continue while limiting broader network exposure. Previously you had only the option to allow outlook, Teams and Skype for business communication to be excluded while in isolation mode.\nNow we the new option you can exclude based on:\nProcess path – You can define a specific executable path. Wildcards are supported for flexibility. Service – You can exclude a Windows service (note: a service is not the same as an application). Package family – The Package Family Name (PFN) is a unique identifier assigned to Windows app packages. Set an exclusion for Intune RemoteWipe ⚠️ Any exclusion weakens device isolation and increases security risks. To minimize risk, configure exclusions only when strictly necessary. Regularly review and update exclusions to align with security policies.\nBefore you can start with configurating the exclusion rules you first need to enable this new feature. You can do this by going to Defender XDR portal under Settings \u0026gt; Endpoints \u0026gt; Advanced Features \u0026gt; Isolation Exclusion Rules.\nNow you are ready to configure the Isolation Exclusion Rules. You can find them again in the Defender XDR portal under Settings \u0026gt; Endpoints \u0026gt; Isolation Exclusion Rules . Click on ‘Add exclusion rule’\nYou will need to configure different policies for every process and services you want to exclude. The following list contains all those exclusions you need to configure to let the Intune remote Wipe work:\nProcess name: C:\\windows\\system32\\omadmclient.exe Example rule for the omadmclient.exe :\nService name: WpnService CrypSvc TokenBroker IntuneManagementExtension dmpwappushservice Example rule for the service dmpwappushservice:\nOnce you have configured the exclusions you will notice that isolation options have changed:\nPreviously, you could simply check a box to automatically exclude apps like Teams, Outlook, or Skype. Now, that checkbox instead controls whether your custom-defined Isolation Exclusion Rules are applied.\nMapping Mitre attack techniques with allowed exclusions I find it important to also point all the Mitre attack Techniques that available for the allowed exclusions. I suggest to review them one by one and determine the risk of them.\nOmadmclient.exe T1569.002 – Service Execution Adversaries may abuse Windows services to execute malicious payloads. Since omadmclient.exe runs as a service, attackers may attempt to hijack or mimic it. T1021.006 – Windows Remote Management (WinRM) WinRM can be used to remotely trigger processes like omadmclient.exe, especially in lateral movement scenarios. T1059 – Command and Scripting Interpreter Attackers may use PowerShell or CMD to invoke or manipulate omadmclient.exe for execution or configuration changes. T1204.002 – User Execution: Malicious File If omadmclient.exe is tricked into executing a malicious configuration or script, it could be part of a user execution chain. T1134 – Access Token Manipulation Attackers may manipulate tokens to run omadmclient.exe under elevated privileges or impersonated contexts. WpnService (Windows Push Notification Service) T1046 – Network Service Discovery Adversaries may scan for services like WpnService to identify targets or vulnerabilities. CrypSvc (Cryptographic Services) T1496 – Resource Hijacking Attackers may abuse system services like CrypSvc for resource-intensive tasks such as cryptomining. TokenBroker T1134 – Access Token Manipulation TokenBroker is involved in authentication flows; attackers may manipulate access tokens to escalate privileges or evade defenses. T1078 – Valid Accounts Abuse of valid tokens and accounts for persistence or lateral movement. IntuneManagementExtension T1176 – Software Extensions Attackers may abuse software deployment mechanisms like IntuneManagementExtension to persist or execute payloads. T1021 – Remote Services Could be used for remote execution or lateral movement via Intune-managed scripts. Dmpwappushservice (WAP Push Message Routing Service) T1003 – OS Credential Dumping May be targeted or monitored during credential harvesting. T**1046 – Network Service Discovery** Could be discovered during scans for exploitable services. T1110 – Brute Force May be involved in brute force attempts if exposed to network authentication. Set an exclusion for Outlook \u0026amp; Teams If you are looking for a solution to exclude Outlook \u0026amp; Teams I can advise to have a look at Louis Mastelinck his blog post about this which you can find here: https://www.lousec.be/mde/isolation-exclusion-rules-fixing-microsoft-teams-outlook-communication-during-isolation/\n","permalink":"https://vertho.tech/2025/10/22/remotely-intune-wipe-devices-in-defender-for-endpoint-isolation-mode/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eMicrosoft recently announced that device isolation exclusions in Defender for Endpoint are now generally available. This made me think about possible use cases for this new feature. Together with \u003ca href=\"https://www.linkedin.com/in/bjornc/\" rel=\"noopener\"\u003eBjorn Claes\u003c/a\u003e, we explored whether it’s possible to exclude the Intune wipe process from isolation mode. If this works, it would allow us to remotely wipe devices using Intune while keeping them in isolation mode within Defender for Endpoint.\u003c/p\u003e\n\u003cp\u003eA special thanks to \u003ca href=\"https://www.linkedin.com/in/rudyooms/\" rel=\"noopener\"\u003eRudy Ooms\u003c/a\u003e for his Intune Insights blogs, which helped us quickly identify the processes and services we needed to investigate. His blogs can you find \u003ca href=\"https://call4cloud.nl/?_gl=1*pj5w4u*_ga*Nzk1MjkyOTM4LjE3NTc0OTU4OTM.*_ga_EQJM48HYCY*czE3NjExNDI0OTAkbzQkZzAkdDE3NjExNDI0OTAkajYwJGwwJGgw\" rel=\"noopener\"\u003ehere\u003c/a\u003e.\u003c/p\u003e","title":"Remotely Intune wipe devices in Defender for Endpoint isolation mode!"},{"content":"Do you also struggle, like I do, to assign the correct permissions in Microsoft Defender XDR RBAC when designing your RBAC model?\nI recently created a visual overview of the current roles and their functions. It helped me a lot in understanding how to structure RBAC properly and I hope it can help you too!\n✅ Clear mapping of roles\n✅ Easier decision-making for access control\n✅ Useful for both technical and governance teams\nFeel free to check it out and let me know your thought, feedback is always welcome!\nLink to Github for download: Defender-XDR/Defender XDR – RBAC design.png at main · v3rtho/Defender-XDR\n#DefenderXDR #RBAC #SecurityArchitecture #MicrosoftSecurity\n","permalink":"https://vertho.tech/2025/09/29/the-ultimate-defender-xdr-rbac-visualization/","summary":"\u003cp\u003eDo you also struggle, like I do, to assign the correct permissions in Microsoft Defender XDR RBAC when designing your RBAC model?\u003c/p\u003e\n\u003cp\u003eI recently created a visual overview of the current roles and their functions. It helped me a lot in understanding how to structure RBAC properly and I hope it can help you too!\u003c/p\u003e\n\u003cp\u003e✅ Clear mapping of roles\u003c/p\u003e\n\u003cp\u003e✅ Easier decision-making for access control\u003c/p\u003e\n\u003cp\u003e✅ Useful for both technical and governance teams\u003c/p\u003e","title":"The ultimate Defender XDR RBAC visualization"},{"content":"Intro There are many helpful blog/videos posts about managing Microsoft Defender for Endpoint (MDE) updates on Windows, but there’s not much information available for MDE on Linux. In this blog post, I’ll share my experience with the product and how I usually recommend managing updates on Linux distributions.\nOn Linux, MDE updates are managed via the package manager native to your Linux distribution (e.g., apt for Ubuntu/Debian, yum or dnf for RHEL/CentOS/Fedora, zypper for SUSE). These updates ensure that the Defender components (like the antimalware engine, EDR sensor, etc.) are kept up-to-date.\nInitial setup When you install Microsoft Defender for Endpoint on Linux, it sets up a repository (e.g., Microsoft’s package feed) specific to your distribution. This repository includes:\nmdatp (Microsoft Defender ATP) Dependencies (like libmtp or other helper tools) Repo config (e.g., /etc/apt/sources.list.d/microsoft.list) Microsoft Defender for Endpoint on Linux receives two main types of updates to keep systems secure and performant:\nProduct Updates – These include improvements to the core MDE agent, new features, performance enhancements, and bug fixes. Security Intelligence Updates – These are frequent updates to malware definitions and detection logic Security intelligence updates for Microsoft Defender for Endpoint on Linux are delivered regularly, typically multiple times per day. You can configure your endpoints to receive updates automatically from Microsoft’s cloud, or set up a local mirror server for offline environments ( Configure offline security intelligence updates for Microsoft Defender for Endpoint on Linux – Microsoft Defender for Endpoint | Microsoft Learn ) . Either way, the goal is to ensure your protection is always up to date.\nEach product version of Defender for Endpoint on Linux is set to expire automatically after 9 months. While expired product versions continue to receive security intelligence updates, install the latest version to get all available fixes and enhancements. To check the expiration date, run the following command:\nmdatp health --field product_expiration Expired clients report a health issue and warning message when you run the following command:\nmdatp health Indicators of an expired client include the message, “ATTENTION: No license found. Contact your administrator for help.” with the following attributes:\nATTENTION: No license found. Contact your administrator for help. healthy : false health_issues : [\u0026#34;missing license\u0026#34;] licensed : false Microsoft publishes monthly product updates with release notes, version numbers, and changes. You can monitor these on the official Linux updates page.\nBesides that MDE on Linux supports multiple update channels:\nBeta (Insider) – Early access to features for testing. Preview (External) – Pre-release builds for broader validation. Current (Production) – Stable, fully tested builds for enterprise deployment. To switch update channels for Microsoft Defender for Endpoint on Linux, you’ll need to uninstall the current package and reinstall it from the desired channel’s repository. You can find full instructions and supported distros on Microsoft’s official deployment guide.\nGood to know When using Microsoft Defender for Servers with the MDE.Linux extension, automatic updates for Defender for Endpoint are enabled by default. This ensures that your security agent stays current without any manual intervention.\nHowever, some customers prefer to keep control in their own hands, especially when managing updates in tightly regulated or mission-critical environments. For these cases, manual update configuration is possible and fully supported on Azure VMs and Azure Arc-enabled machines.\nTo disable automatic updates, simply tag the machine with:\nTag name: ExcludeMdeAutoUpdate Tag value: true This gives you full control over when and how Defender for Endpoint gets updated.Manual manage products updates\nKeep control in your own hands But what if you want to keep control in your own hands and schedule the updates based on your company wide approved update cycle? Manual updating your defender for Linux? Manual tasks can be resource heavy because they often require significant time, focus, and repetitive effort, especially when done at scale. They increase the risk of human error and slow down workflows that could otherwise be streamlined. To tackle this, I created an OS independent script that automates the process, making it faster, more consistent, and easier to implement. You can also push the script with your favorite automation tool (puppet, ansible etc.).\nIt will not only configure when the product updates take place, it will also configure the intelligence update scan cycle and quick scan, if desired. All of these tasks are configured using cronjobs, giving you fine-grained control over execution times.\nCurrently support package managers yum – Used in RHEL-based distributions (Red Hat, CentOS, Fedora older versions). apt-get – Used in Debian-based distributions (Debian, Ubuntu, etc.). zypper – Used in SUSE-based distributions (openSUSE, SUSE Linux Enterprise). Script details Before diving into the script itself, here’s a high level overview of what it does behind the scenes to help automate and customize Defender for Endpoint updates on Linux systems:\nCheck if the script is running as root Dump the current crontab to a temporary file Check if crontab jobs are already present Select the correct package manager Add the scan, intel and quick scan entries to the crontab Load the new crontab Echo the new loaded crontab to validate configuration The full script #!/bin/bash # Created by Thomas Verheyden - 01-07-2025 # Verify we are running as root if [ \u0026#34;$EUID\u0026#34; -ne 0 ]; then echo \u0026#34;Please run as root\u0026#34; exit fi echo \u0026#34;This script will install 3 cronjobs for Defender\u0026#34; echo \u0026#34; - Update defender (Saturday)\u0026#34; echo \u0026#34; - Defender quick scan (Sunday)\u0026#34; echo \u0026#34; - Defender Intelligence update (Every hour)\u0026#34; echo \u0026#34;\u0026#34; # Dump the current crontab to a temporary file tmpfile=$(mktemp /tmp/crontab.XXXXXX) crontab -l 2\u0026gt;/dev/null \u0026gt; $tmpfile # Check if crontab is already present if cat ${tmpfile} | grep -q mdatp; then echo \u0026#34;It seems that there is already a cronjob present for mdatp. Aborting\u0026#34; exit fi # Select correct update command which yum \u0026gt;/dev/null \u0026amp;\u0026amp; update_command=\u0026#39;yum update mdatp -y \u0026gt; /root/mdatp_update_cron_job.log\u0026#39; which apt-get \u0026gt;/dev/null \u0026amp;\u0026amp; update_command=\u0026#39;apt-get install --only-upgrade mdatp \u0026gt; /root/mdatp_update_cron_job.log\u0026#39; which zypper \u0026gt;/dev/null \u0026amp;\u0026amp; update_command=\u0026#39;zypper update mdatp \u0026gt; /root/mdatp_update_cron_job.log\u0026#39; if [ -z \u0026#34;$update_command\u0026#34; ]; then echo \u0026#34;Script could not determine the package manager that should be used. Aborting\u0026#34; exit fi # Add our entries to crontab scan_command=\u0026#39;/bin/mdatp scan quick \u0026gt; /root/mdatp_cron_job.log\u0026#39; Intel_command=\u0026#39;/bin/mdatp definitions update \u0026gt; /root/mdatp_cron_job.log\u0026#39; echo \u0026#34;0 2 * * sat ${update_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile echo \u0026#34;0 2 * * sun ${scan_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile echo \u0026#34;0 * * * sun ${Intel_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile # Load the new crontab crontab $tmpfile echo \u0026#34;Current crontab:\u0026#34; crontab -l echo \u0026#34;\u0026#34; echo \u0026#34;Done.\u0026#34; # Cleanup rm $tmpfile You can also find it on my Github:\nDefender-for-endpoint/Linux – Config-UpdateScanIntel-CronJob .sh at main · ThomasVrhydn/Defender-for-endpoint\nFields to edit If you want to change the day/time when the different jobs run in the crontab , you need to edit row 39 till 41 of the script below by using the following syntax:\n* * * * * yum update mdatp -y │ │ │ │ │ │ │ │ │ └─── Day of the week (0 - 7) (Sunday = 0 or 7) │ │ │ └───── Month (1 - 12) │ │ └─────── Day of the month (1 - 31) │ └───────── Hour (0 - 23) └─────────── Minute (0 - 59) Example:\n0 3 * * 1 yum update mdatp -y This product updates will run every Monday at 3:00 AM. If you only want to configure the product update cycles , you need to remove the lines with the scan and intel commands( by default line 40 \u0026amp; 41):\necho \u0026#34;0 2 * * sat ${update_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile echo \u0026#34;0 2 * * sun ${scan_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile echo \u0026#34;0 * * * sun ${Intel_command}\u0026#34; \u0026gt;\u0026gt; $tmpfile Monitor product updates for MDE on linux There are different ways to monitor the product updates on your endpoint:\nUse the CLI Track update history Device inventory Defender XDR portal Advanced hunting Advanced hunting I usually use this following query for Windows endpionts to receive the products version information and MDE status:\nlet avmodetable = DeviceTvmSecureConfigurationAssessment | where ConfigurationId == \u0026#34;scid-2010\u0026#34; and isnotnull(Context) | extend avdata = parsejson(Context) | extend AVMode = iif(tostring(avdata[0][0]) == \u0026#39;0\u0026#39;, \u0026#39;Active\u0026#39;, iif(tostring(avdata[0][0]) == \u0026#39;1\u0026#39;, \u0026#39;Passive\u0026#39;, iif(tostring(avdata[0][0]) == \u0026#39;4\u0026#39;, \u0026#39;EDR Blocked\u0026#39;, \u0026#39;Unknown\u0026#39;))) | project DeviceId, AVMode; DeviceTvmSecureConfigurationAssessment | where ConfigurationId == \u0026#34;scid-2011\u0026#34; and isnotnull(Context) | extend avdata = parsejson(Context) | extend AVSigVersion = tostring(avdata[0][0]), AVEngineVersion = tostring(avdata[0][1]), AVSigLastUpdateTime = tostring(avdata[0][2]), AVProductVersion = tostring(avdata[0][3]) //| project DeviceId, DeviceName, OSPlatform, AVSigVersion, AVEngineVersion, AVSigLastUpdateTime, AVProductVersion, IsCompliant, IsApplicable | join kind=inner avmodetable on DeviceId | project-away DeviceId1 The DeviceTvmSecureConfigurationAssessment table sometimes includes this in the Context field under ConfigurationId == “scid-2011”, but as you’ve seen, that field is often empty for Linux endpoints.\nIf you run run the same query for Windows platform you will give much more information about the MDE version:\nThere is another configuration item in the DeviceTvmSecureConfigurationAssessment “Update Microsoft Defender for Endpoint core components” under ConfigurationId == “scid-6095”. This item check if productversion update is required, meaning the agent is older then 9 months. When you combine everything you get the following query:\nDeviceTvmSecureConfigurationAssessment | where ConfigurationId == \u0026#34;scid-6095\u0026#34; and isnotnull(Context) and OSPlatform == \u0026#34;Linux\u0026#34; | extend avdata = parsejson(Context) | extend AVSigVersion = tostring(avdata[0][0]), AVEngineVersion = tostring(avdata[0][1]), AVSigLastUpdateTime = tostring(avdata[0][2]), AVProductVersion = tostring(avdata[0][3]), AVIsUptoDate = tostring(IsCompliant) | project DeviceName, OSPlatform, AVSigVersion, AVEngineVersion, AVSigLastUpdateTime, AVProductVersion, AVIsUptoDate As you can see i added a extra column AVIsUptoDate which will be true if the endpoint is compliant against the “Update Microsoft Defender for Endpoint core components”, also the AVSigVersion, AVEngineVersion and AVLastUpdateTime will be provided.\nIf you run the query the output will look like this:\nCLI Run the following command to view the current product version and expiration from the CLI:\nmdatp health --field product_expiration mdatp health --field app_version You can check your system’s package manager logs for updates references:\nDebian/Ubuntu: grep mdatp /var/log/dpkg.log RHEL/CentOS: grep mdatp /var/log/yum.log SLES: grep mdatp /var/log/zypper.log Defender portal On the device inventory page in the defender portal you can check the product update state also:\n","permalink":"https://vertho.tech/2025/08/27/guidance-on-how-to-manage-products-updates-for-defender-for-server-on-linux-distributions/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eThere are many helpful blog/videos posts about managing Microsoft Defender for Endpoint (MDE) updates on Windows, but there’s not much information available for MDE on Linux. In this blog post, I’ll share my experience with the product and how I usually recommend managing updates on Linux distributions.\u003c/p\u003e\n\u003cp\u003eOn Linux, MDE updates are managed via the package manager native to your Linux distribution (e.g., apt for Ubuntu/Debian, yum or dnf for RHEL/CentOS/Fedora, zypper for SUSE). These updates ensure that the Defender components (like the antimalware engine, EDR sensor, etc.) are kept up-to-date.\u003c/p\u003e","title":"Guidance on how to manage products updates for Defender for Server on Linux distributions"},{"content":"Intro This week I bumped into a problem that I had not experienced for several years at one of my customers. The customer was migrating from a 3rd-party EDR to Defender for Endpoint on their servers. During the onboarding they wanted to enable the Defender Antivirus server role and they run against the following error:\nRemoving unnecessary Windows Server features was a best practice an couple of years ago because it reduced the attack surface, improving security by limiting potential vulnerabilities. It also made the server image smaller and faster to deploy, which enhanced performance and resource efficiency. I once saw it on a Windows Server 2016 image but this time it was on a windows server 2022 image, so its stil actual and the reality …\nSo, how can you import the sources back into the image? Let me explain in this blog post.\nHigh level – Prerequisite As a prerequisite to get the sources back ingested you need the image of the partial operation system. After that you need to do the following steps:\nUpgrade the image with the latest patches , quality updates (Windows server 2016 only) Install the Windows defender binaires of the image Step by step approach Step 1: Download the Operating system ISO file for the OS where you want to enable the Defender AV feature on from the microsoft evalution website. Microsoft Evaluation Center\nStep 2: Mount the image file by opening File Explorer and navigate to the ISO image file. Right-click on the file and select Mount. The image will be mounted to a drive and displayed in the File Explorer drives and folders tree. In my case the H: drive.\nStep 3: The ISO contains multiple install images. We need to determine the correct installed version of the image. In my case it’s the ‘Windows Server 2016 Standard (Desktop Experience)”. This is depending on the operating system you are using and where you want to enable Defender AV feature role. You can determine the correct version with the following command:\ndism /Get-WimInfo /WimFile:h:\\sources\\install.wim Step 4: Now we know the correct index of the image file we need, now its time to export that image:\ndism /export-image /SourceImageFile:H:\\sources\\install.wim /SourceIndex:2 /DestinationImageFile:c:\\install.wim /Compress:max /CheckIntegrity ⚠️ If you are using windows 2019 or high you can skip to step 9. Updating the image file is only recommend on Windows serve 2016 images.\nStep 5: The next step is to mount the new image file so we can edit it\ndism /mount-wim /WimFile:c:\\install.wim /index:1 /mountDir:c\\mountdir Step 6: Now we need to download the lastest commulative update for the Windows server 2016\nStep 7: Time to ad the update to the mounted image file\ndism /Add-package /Image:c:\\mountdir\\ /PackagePath:c:\\MSU\\window10.0-kb4103720-x64_c1fb7676d38fffae5c28b9216220c1f033ce26ac.msu /logPath:ADDPackage.log Step 8: Save the image file by unmouting it\ndism /Unmount-WIM /MountDir:C:\\mountdir /Commit Step 9: As the last step is we need to enable the defender AV binaries from the image file we updated.\ndism /Online /Enable-Feature /FeatureName:Windows-Defender /all /source:WIM:c\\install.wim:1 /LimitAccess After completing this step, the Windows Defender Antivirus feature should be enabled, allowing you to proceed with your Defender for Endpoint migration!!\n","permalink":"https://vertho.tech/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eThis week I bumped into a problem that I had not experienced for several years at one of my customers. The customer was migrating from a 3rd-party EDR to Defender for Endpoint on their servers. During the onboarding they wanted to enable the Defender Antivirus server role and they run against the following error:\u003c/p\u003e\n\u003cp\u003e\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/image-9.png\"\u003e\u003c/p\u003e\n\u003cp\u003eRemoving unnecessary Windows Server features was a best practice an couple of years ago because it reduced the attack surface, improving security by limiting potential vulnerabilities. It also made the server image smaller and faster to deploy, which enhanced performance and resource efficiency. I once saw it on a Windows Server 2016 image but this time it was on a windows server 2022 image, so its stil actual and the reality …\u003c/p\u003e","title":"Defender AV Mystery: Solving the ‘Source Files could Not be Found’"},{"content":"What’s new:\n– Inspired by Yong Rhee “Resolving High CPU Utilization in MDE” session, added additional options to run the Performance analyzer, Overview is now by default.\n– Added ASR rules that went GA\n– Added a check if DeviceControl is enabled\n– Added Proxy ULR/PAC check\n– Added check to see if signature update are out of date\nDownload:\nGitHub – ThomasVrhydn/MDE-troubleshooter: This tool is designed to assist you in analyzing issues related to Defender for Endpoint on your local endpoint. It offers a centralized view of the security configuration, log files, updates, and provides access to the Performance Analyzer.\nAs always , new ideas are always welcome !\n","permalink":"https://vertho.tech/2025/06/07/mde-troubleshooter-v1-6-1-available/","summary":"\u003cp\u003eWhat’s new:\u003cbr\u003e\n– Inspired by \u003ca href=\"https://www.linkedin.com/in/yongrhee-msft/\" rel=\"noopener\"\u003eYong Rhee\u003c/a\u003e “Resolving High CPU Utilization in MDE” session, added additional options to run the Performance analyzer, Overview is now by default.\u003cbr\u003e\n– Added ASR rules that went GA\u003cbr\u003e\n– Added a check if DeviceControl is enabled\u003cbr\u003e\n– Added Proxy ULR/PAC check\u003cbr\u003e\n– Added check to see if signature update are out of date\u003c/p\u003e\n\u003cp\u003eDownload:\u003cbr\u003e\n\u003ca href=\"https://github.com/ThomasVrhydn/MDE-troubleshooter\" rel=\"noopener\"\u003eGitHub – ThomasVrhydn/MDE-troubleshooter: This tool is designed to assist you in analyzing issues related to Defender for Endpoint on your local endpoint. It offers a centralized view of the security configuration, log files, updates, and provides access to the Performance Analyzer.\u003c/a\u003e\u003c/p\u003e","title":"MDE-Troubleshooter v1.6.1 available"},{"content":"During my work with customers, when I explain the tenant allow and block features in Microsoft Defender for Office 365 P1/P2, I often get the question: why did Microsoft make this so hard to understand? That comment gave me the idea to create a visual representation of the features to make them easier to understand.\nYou can find the visualisation below or on my github:\nDefender-For-O365/MDO – Allow-Deny list.jpg at main · ThomasVrhydn/Defender-For-O365\n","permalink":"https://vertho.tech/2025/05/07/defender-for-office-365-visualisation-of-the-tenant-allow-block-list-features/","summary":"\u003cp\u003eDuring my work with customers, when I explain the tenant allow and block features in Microsoft Defender for Office 365 P1/P2, I often get the question: why did Microsoft make this so hard to understand? That comment gave me the idea to create a visual representation of the features to make them easier to understand.\u003c/p\u003e\n\u003cp\u003eYou can find the visualisation below or on my github:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/ThomasVrhydn/Defender-For-O365/blob/main/MDO%20-%20Allow-Deny%20list.jpg\" rel=\"noopener\"\u003eDefender-For-O365/MDO – Allow-Deny list.jpg at main · ThomasVrhydn/Defender-For-O365\u003c/a\u003e\u003c/p\u003e","title":"Defender for Office 365: Visualisation of the Tenant Allow/Block List features"},{"content":"Intro While reviewing Defender for Servers and AMA agent implementations across various customers, I noticed that not all of them are following best security practices for Azure Arc deployments. In this blog, I want to highlight several security concerns and provide recommendations on how to mitigate them…\nWhy should we care? The Azure Connected Machine agent aka Azure Arc agent is a combination of four services/daemons that run on your server and help connect it with Azure. They’re installed together as a single application and are managed centrally using the azcmagent command line interface.\nHybrid Instance Metadata Service Extension manager Guest configuration Azure Arc proxy Two of those services, extension manager and guest configuration, run under the local system account and root on Linux. The Local System account in Windows is the highest privilege built-in account. It has full administrative control over the system, including:\nCan start, stop, and manage services, including system-critical ones. Full access to files, registry, and system processes. Runs as NT AUTHORITY\\SYSTEM, which has more privileges than an administrator. Acts as the computer account (DOMAIN\\COMPUTERNAME$) when accessing network resources. Acts as the computer account (DOMAIN\\COMPUTERNAME$) when accessing network resources. If compromised, an attacker gains complete control over the system, making it a prime target for privilege escalation attacks. The same can be said about root access on Linux.\nThe Azure Arc proxy service runs as Network Service account and a standard user on Linux. The Network Service account on Windows has lower privileges than Local System, but it still has more privileges than a standard user. It is considered a built-in service account designed to run network-facing services with minimum necessary privileges. Network Service is not a high-privilege role, but it has enough permissions that, if compromised, it could be used in an attack to escalate privileges. The good thing is that its disabled by default until you configure the agent to user the Azure Arc Gateway.\nBest practices implementation There are two best practices I would recommend. These recommendation are not a requirement but I strongly recommend to maintain the security posture of your highly important assets:\nDisable unnecessary management features Dedicated Azure subscription ⚠️ Before you proceed, make sure to consult with your server management stakeholders. You want to avoid disabling functionality that, while unused by you, may be essential for other stakeholders within your organization.\nDisable unnecessary management features: I will focus solely on how to lock down the Azure Arc agent in the context of Defender for Server and the Azure Monitoring Agent for collecting security logs, as these are the tools I use most frequently in my Defender XDR/Sentinel implementations. If you got an another use case i highly suggest to have a look at Wim Matthyssen blog post where he shows how to configure a broader allowlist for the Extensions manager:\nAzure Arc: Customize the extension allowlist for Azure Arc-enabled Windows Servers – Wim Matthyssen\nWe will use the Azure Connected Machine agent command line tool, azcmagent, which helps you configure , manage, and troubleshoot a server’s connection with Azure Arc. The good thing is this is supported both for Windows and Linux. Before you can use this command line tool you need access to the machine. There are different possibilities to have access on machines but in this example used the most basic on by logging on the asset.\nBelow we are going to disable any unused functionality in the agent to prevent any intentional or accidental use of those features to make changes to the server. This includes:\nDisabling the machine configuration agent if you don’t intend to use machine configuration policies Disabling remote access capabilities Setting an extension allowlist for the extensions you intend to use, or disabling the extension manager if you are not using extensions Linux When connected to the machine, open your terminal with root permissions and type in the following commands:\nazcmagent config set incomingconnections.enabled false azcmagent config set guestconfiguration.enabled false azcmagent config set extensions.allowlist “Microsoft.Azure.Monitor/AzureMonitorWindowsAgent,Microsoft.Azure.AzureDefenderForServers/MDE.Windows” If everything went well you will receive the following output:\nexecution of commands\nYou can always validate your configuration by running the following command:\nValidation of configuration\nYou can also automate the deployment by adding the lines to you onboarding script that you use for the installation of the Azure Arc agent:\n# Run post hardening script Sleep 30 sudo azcmagent config set incomingconnections.enabled false sudo azcmagent config set guestconfiguration.enabled false sudo azcmagent config set extensions.allowlist “Microsoft.Azure.Monitor/AzureMonitorWindowsAgent,Microsoft.Azure.AzureDefenderForServers/MDE.Windows” Example:\nScreenshot of install script add on\nWindows When connected to the machine, open powershell with administrative permissions and type in the following commands:\ncd \u0026#34;C:\\Program Files\\AzureConnectedMachineAgent\u0026#34; .\\azcmagent.exe config set incomingconnections.enabled false .\\azcmagent.exe config set guestconfiguration.enabled false .\\azcmagent.exe config set extensions.allowlist “Microsoft.Azure.Monitor/AzureMonitorWindowsAgent,Microsoft.Azure.AzureDefenderForServers/MDE.Windows” Your normally receive a output that the values has been change (in my example in dutch):\nConfiguration\nAlso on Windows you can validate your configuration by running the following command (check your working directory):\n.\\azcmagent.exe config list Output:\nValidation of configuration\nYou can also automate the configuration by adding the following lines to the bottom of your onboarding script:\n## Post Azure Arc hardening steps try{ Start-Sleep -Seconds 30 $AgentLocation = \u0026#34;$env:ProgramW6432\\AzureConnectedMachineAgent\\azcmagent.exe\u0026#34; if($AgentLocation){ cd \u0026#34;$env:ProgramW6432\\AzureConnectedMachineAgent\\\u0026#34; ./azcmagent.exe config set incomingconnections.enabled false ./azcmagent.exe config set guestconfiguration.enabled false ./azcmagent.exe config set extensions.allowlist “Microsoft.Azure.Monitor/AzureMonitorWindowsAgent,Microsoft.Azure.AzureDefenderForServers/MDE.Windows” Write-Host -ForegroundColor Green \u0026#34;Post Azure Arc hardenning settings configured !\u0026#34; }Else{ Write-Host -ForegroundColor red \u0026#34;Post Azure Arc hardenning settings FAILED !\u0026#34; } }catch{ Write-Host -ForegroundColor red $_.Exception } Dedicated Azure subscription: I totally understand that this recommendation is really depending on the Azure organizational structure but you should treat any subscription or management group admin as equivalent to a local administrator on assets. They can grant themselves access by assigning new roles to the Azure Arc resource. Additionally, policies applied at these levels may have the authority to modify the server’s configuration.\nTo reduce the number of accounts and policies with access to your highly important assets, use a dedicated Azure subscription that is tightly monitored and has minimal persistent administrators. Additionally, review Azure policies in parent management groups to ensure they align with your security objectives for these servers.\nSummary That’s it! You can now lock down your Azure Arc agent to only include the necessary functionality on both Windows and Linux machines. However, before you proceed, make sure to consult with your server management stakeholders. You want to avoid disabling functionality that, while unused by you, may be essential for other stakeholders within your organization.\n","permalink":"https://vertho.tech/2025/04/14/using-azure-arc-only-for-defender-for-servers-or-azure-monitoring-agent-lock-it-down/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eWhile reviewing Defender for Servers and AMA agent implementations across various customers, I noticed that not all of them are following best security practices for Azure Arc deployments. In this blog, I want to highlight several security concerns and provide recommendations on how to mitigate them…\u003c/p\u003e\n\u003ch2 id=\"why-should-we-care\"\u003eWhy should we care?\u003c/h2\u003e\n\u003cp\u003eThe Azure Connected Machine agent aka Azure Arc agent is a combination of four services/daemons that run on your server and help connect it with Azure. They’re installed together as a single application and are managed centrally using the azcmagent command line interface.\u003c/p\u003e","title":"Using Azure Arc only for Defender for Servers or Azure monitoring Agent? Lock it down!"},{"content":"Intro Microsoft recently announced that OAuth applications are now integrated into the attack path experience within Exposure Management. This also means that all the data available in the Attack surface map is also available in advanced hunting in the Exposure Management tables. This triggered me to have a look at the available data and I could quickly created some use cases around it which I wanted to share with the community.\nDon’t limit yourself to my use cases—think outside the box, explore new possibilities, and create your own. Let me know what you come up with. Happy hunting!\nOAuth applications with Microsoft Graph permissions Let’s start with a basic use case. let’s have a look at the OAuth applications that have app permissions or delegated permissions to the Microsoft Graph:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and and NodeGraph.NodeName =~ \u0026#34;Microsoft Graph\u0026#34; project NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo,NodeGraph.NodeName, NodeGraph.NodeLabel Now lets limited it only to the application that your tenant is owner off:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and NodeOauthApp.NodeProperties.rawData.isBelongToExternalApplication contains \u0026#34;False\u0026#34; and NodeGraph.NodeName =~ \u0026#34;Microsoft Graph\u0026#34; project NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo,NodeGraph.NodeName, NodeGraph.NodeLabel Lets us add an additional attack path to it. Lets hunt for users that has any kind of role on the application which has app permissions to the MS Graph\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeUser)-[HasRoleOn]-\u0026gt;(NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where HasRoleOn.EdgeLabel =~ \u0026#34;has role on\u0026#34; and CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and (NodeOauthApp.NodeProperties.rawData.isBelongToExternalApplication contains \u0026#34;False\u0026#34; and NodeGraph.NodeName =~ \u0026#34;Microsoft Graph\u0026#34;) project NodeUser.NodeName, HasRoleOn,NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo,NodeGraph.NodeName, NodeGraph.NodeLabel How can an attacker obtain credentials of users? Yes, on vulnerable devices with unprotected credentials in memory. Lets add them as a additional attack path connection:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (DeviceWithRCE)-[HasCredentialsOf]-\u0026gt;(NodeUser)-[HasRoleOn]-\u0026gt;(NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where HasCredentialsOf.EdgeLabel =~ \u0026#34;has credentials of\u0026#34; and HasRoleOn.EdgeLabel =~ \u0026#34;has role on\u0026#34; and CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and (NodeOauthApp.NodeProperties.rawData.isBelongToExternalApplication contains \u0026#34;False\u0026#34; and NodeGraph.NodeName =~ \u0026#34;Microsoft Graph\u0026#34;) and (DeviceWithRCE.Categories == \u0026#34;[\u0026#34;\u0026#34;compute\u0026#34;\u0026#34;,\u0026#34;\u0026#34;device\u0026#34;\u0026#34;,\u0026#34;\u0026#34;virtual_machine\u0026#34;\u0026#34;]\u0026#34;) project DeviceWithRCE.NodeName,HasCredentialsOf.EdgeLabel,NodeUser.NodeName,HasRoleOn.EdgeLabel,NodeOauthApp.NodeName,NodeOauthApp.NodeLabel,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal.NodeName,HasPermissionsTo.EdgeLabel,NodeGraph.NodeName, NodeGraph.NodeLabel Service Principals permissions to Azure resources During searching through all the available data i found another interesting use case. I saw that there are a lot of raw data available around Servie principals in the tables. Let’s have a look at the Service Principals with access to your Azure resources:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and NodeGraph.NodeLabel =~ \u0026#34;subscriptions\u0026#34; project NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo.EdgeProperties.rawData.permissions.roles,NodeGraph.NodeName, NodeGraph.NodeLabel Lets limit to only owner or contributor roles:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and NodeGraph.NodeLabel =~ \u0026#34;subscriptions\u0026#34; and (HasPermissionsTo.EdgeProperties.rawData.permissions.roles contains \u0026#34;owner\u0026#34; or HasPermissionsTo.EdgeProperties.rawData.permissions.roles contains \u0026#34;contributor\u0026#34;) project NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo.EdgeProperties.rawData.permissions.roles,NodeGraph.NodeName, NodeGraph.NodeLabel Let add the user who have a role on those service principals:\nExposureGraphEdges | make-graph SourceNodeId --\u0026gt; TargetNodeId with ExposureGraphNodes on NodeId | graph-match (NodeUser)-[HasRoleOn]-\u0026gt;(NodeOauthApp)-[CanAuthenticateAs]-\u0026gt;(NodeServicePrincipal)-[HasPermissionsTo]-\u0026gt;(NodeGraph) where HasRoleOn.EdgeLabel =~ \u0026#34;has role on\u0026#34; and CanAuthenticateAs.EdgeLabel =~ \u0026#34;can authenticate as\u0026#34; and HasPermissionsTo.EdgeLabel =~ \u0026#34;has permissions to\u0026#34; and NodeGraph.NodeLabel =~ \u0026#34;subscriptions\u0026#34; and (HasPermissionsTo.EdgeProperties.rawData.permissions.roles contains \u0026#34;owner\u0026#34; or HasPermissionsTo.EdgeProperties.rawData.permissions.roles contains \u0026#34;contributor\u0026#34;) project NodeUser.NodeName, HasRoleOn, NodeOauthApp.NodeName,NodeOauthApp,CanAuthenticateAs.EdgeLabel,NodeServicePrincipal,HasPermissionsTo.EdgeProperties.rawData.permissions.roles,NodeGraph.NodeName, NodeGraph.NodeLabel Finishing My examples are limited to my own use cases, but I hope they provide an idea of the available capabilities enabled by having access to raw data on OAuth applications and Service Principals. If you’re developing your own hunting queries or have other use cases in mind, feel free to reach out—I’d be happy to create queries tailored to your needs!”\n","permalink":"https://vertho.tech/2025/03/25/proactive-exposure-hunting-oauth-applications-and-azure-permissions/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eMicrosoft recently announced that OAuth applications are now integrated into the attack path experience within \u003ca href=\"https://learn.microsoft.com/en-us/security-exposure-management/enterprise-exposure-map\" rel=\"noopener\"\u003eExposure Management\u003c/a\u003e. This also means that all the data available in the Attack surface map is also available in advanced hunting in the Exposure Management tables. This triggered me to have a look at the available data and I could quickly created some use cases around it which I wanted to share with the community.\u003c/p\u003e","title":"Proactive Exposure hunting: OAuth Applications and Azure permissions"},{"content":"Intro Lately, I’ve been exploring Microsoft Exposure Management, particularly the data available in the Enterprise Exposure Graph. One interesting use case I’ve identified is leveraging this data to quickly gain an overview of all managed identities and their configured permissions in Azure.\nI also created a technical talk about Microsoft Exposure management capabilities, hopefully my talk will be accepted soon, stay tuned!\nAdditionally I also created a GitHub repo with all the use case queries I already made in the past which you can find here: Microsoft-Exposure-management-/ at main · ThomasVrhydn/Microsoft-Exposure-management-\nIn the meantime I suggest to read Sami Lamppu blog(s) if you want to learn more about Microsoft Exposure management:\n🔗 Microsoft Security Exposure Management (XSPM) Overview – Part 1\nThe fundamentals The Enterprise Exposure Graph consist out of two important tables:\nExposureGraphNodes ExposureGraphNodes contains organizational entities and their properties. These include entities like devices, identities, user groups, and cloud assets such as virtual machines (VMs), storage, and containers. Each node corresponds to an individual entity and encapsulates information about its characteristics, attributes, and security related insights within the organizational structure. ExposureGraphEdges The ExposureGraphEdges schema, along with the complementing ExposureGraphNodes schema, provides visibility into relationships between entities and assets in the graph. Many hunting scenarios require exploration of entity relationships and attack paths. For example, when hunting for devices exposed to a specific critical vulnerability, knowing the relationship between entities, can uncover critical organizational assets. For the use case ‘Managed identities permissions overview’ I’m only going to use the ExposureGraphEdges tables, in later blogs i will explain more about the ExposureGraphNodes table and how you can use them together and even create your own multi relationships graphs!\nExposureGraphEdges The ExposureGraphEdges has some very interesting columns available. The colums I use the most are:\nEdgeLabel (string) – The edge label. Examples: “has permissions to” “routes traffic to,” “is running,” and “contains.” SourceNodeId (string) – Node ID of the edge’s source. Example: “12346aa0-10a5-587e-52f4-280bfc014a08” SourceNodeName (string) – The source node display name. Example: “mdvmaas-win-123” SourceNodeLabel (string) – The source node label. Example: “microsoft.compute/virtualmachines” TargetNodeId (string) – The node ID of the edge’s target. Example: “45676aa0-10a5-587e-52f4-280bfc014a08” TargetNodeName (string) – Display name of the target node. Example: gke-test-cluster-1 TargetNodeLabel (string) – The target node label. Example: “compute.instances” EdgeProperties (Dynamic (json)) – Optional data relevant for the relationship between the nodes. I really suggest to use this basic query to understand the possibilities of all the relationships, also have a look at all the different SourceNodeLabel and TargetNodeLabel that are available.\nExposureGraphEdges | distinct EdgeLabel, // | distinct SourceNodeLabel // | distinct TargetNodeLabel The Use Case: Managed Identities permissions Overview The Enterprise Exposure Graph has a lot of RAW data available. Part of this available data is about EntraID and Azure resource data. There is an EdgeLabel that has the value “has permissions to” which can help us with building our one to one relationship between an EntraID entity( a managed identity in this case) and an Azure Resources and that’s exactly what we going to use for this use case: “Managed identities permissions overview”.\nThe RAW data we are looking for in this use case is available in the EdgeProperties column. When you print out you will notice the raw data is formatted in a JSON structure. Besides the EdgeProperties the SourceNodeName , TargetNodeLabel, (Roles)Name can be interesting.\nExposureGraphEdges | where SourceNodeLabel == \u0026#34;managedidentity\u0026#34; | extend d = parse_json(EdgeProperties) | extend Roles = d.rawData.permissions.roles | mv-expand Roles | extend Actions = Roles.actions | extend RoleName = Roles.name | project SourceNodeName, TargetNodeLabel, RoleName, Actions Depending on your environment this query can time-out and you will receive the following error:\nWhat I suggest when you recieve that error is to start filtering early in your query. You can use the TargetNodeLabel for this. In the example below I only want to see the permissions on my Key Vault resources. You can do this by filtering on “microsoft.keyvault/vaults”:\nExposureGraphEdges | where SourceNodeLabel == \u0026#34;managedidentity\u0026#34; and TargetNodeLabel == \u0026#34;microsoft.keyvault/vaults\u0026#34; | extend d = parse_json(EdgeProperties) | extend Roles = d.rawData.permissions.roles | mv-expand Roles | extend Actions = Roles.actions | extend RoleName = Roles.name | project SourceNodeName, TargetNodeLabel, RoleName, Actions Example out put:\nOutput of permissions on KeyVault\nOr mabye you first want to start with high privilege roles such as Owner or Contributor. You can achieve this by filtering on the RoleName:\nExposureGraphEdges | where SourceNodeLabel == \u0026#34;managedidentity\u0026#34; and TargetNodeLabel == \u0026#34;microsoft.keyvault/vaults\u0026#34; | extend d = parse_json(EdgeProperties) | extend Roles = d.rawData.permissions.roles | mv-expand Roles | extend Actions = Roles.actions | extend RoleName = Roles.name | where RoleName contains \u0026#34;Contributor\u0026#34; or RoleName contains \u0026#34;Owner\u0026#34; | project SourceNodeName, TargetNodeLabel, RoleName, Actions Or you just want to quickly see who has owner rights on your Azure Resources:\nExposureGraphEdges | extend d = parse_json(EdgeProperties) | extend Roles = d.rawData.permissions.roles | mv-expand Roles | extend Actions = Roles.actions | extend RoleName = Roles.name | where RoleName contains \u0026#34;Owner\u0026#34; | project SourceNodeName, TargetNodeLabel, RoleName, Actions Output:\nOutput of all the Owners roles in Azure\nAs you can see there are a lot of possibilities you can do when you have access to all the RAW data. I will create more blogs with additional use cases and more complex queries in the future! For example how you can create you own attacks paths with relationships 3 to 8 deep!\n","permalink":"https://vertho.tech/2025/02/19/unleash-the-power-of-enterprise-exposure-graph-managed-identities-permissions-overview/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eLately, I’ve been exploring Microsoft Exposure Management, particularly the data available in the Enterprise Exposure Graph. One interesting use case I’ve identified is leveraging this data to quickly gain an overview of all managed identities and their configured permissions in Azure.\u003c/p\u003e\n\u003cp\u003eI also created a technical talk about Microsoft Exposure management capabilities, hopefully my talk will be accepted soon, stay tuned!\u003c/p\u003e\n\u003cp\u003eAdditionally I also created a GitHub repo with all the use case queries I already made in the past which you can find here: \u003ca href=\"https://github.com/ThomasVrhydn/Microsoft-Exposure-management-/tree/main\" rel=\"noopener\"\u003eMicrosoft-Exposure-management-/ at main · ThomasVrhydn/Microsoft-Exposure-management-\u003c/a\u003e\u003c/p\u003e","title":"Unleash the power of Enterprise Exposure Graph: Create a Managed Identities Permissions Overview"},{"content":"Intro Encountering a false negative during a customer engagement can be a critical issue. Recently, I faced a similar situation where a particular exploit went undetected. While I won’t delve into the specifics of the exploit, I want to highlight an efficient method to report false negatives promptly for resolution.\nIn my recent experience, the false negative case was addressed within just 4 days of thorough investigations.\n⚠️ During my writing (25/12) , Microsoft updated their docs about “how to address Address false positives/negatives in Microsoft Defender for Endpoint” (12/01). I suggest to also read it. You can find it here , it covers more use case then my blog.\nEvidence My advise is before you submit your case, get as much evidence you can provide. Here is a list I put into my case:\nDescribed the steps that would allow Microsoft to reproduce the issue internally A document backed with screenshots of the process and devices involved incl. Device ID where the activity was observed, the org ID , the exact date/time of the event (in UTC preferably) , the event details and observed telemetry (device timeline) Clarified what was the vulnerability that was exploited and that was not alerted incl. CVE Reference. Reproduced the issue with the lasted version of MDATP and confirmed if the alert is triggered in the MDE portal Collected logs from the device that was exploited: For linux use the XMDEClientAnalyzer http://aka.ms/XMDEClientAnalyzer For Windows use the MDATPanalyzer https://aka.ms/mdatpanalyzer Submission There are a couple public submission methods: Microsoft Security Intelligence MSRC Researcher Portal Support Case in costumer tenant The first two didn’t fit into my category, its more if you want to report malicious files, URL’s or security research. So what I did was, I created a support case in the costumers tenant:\nGo to https://security.microsoft.com/ On the right op click on ‘Help’ 3. Choose a contact method and preferred settings Fill in the additional required fields and upload the evidence you created earlier. It’s important to put the following line in your title: “EDR False Negative (FN) Detection.” 5. click on ‘Contact me’ That is! Now the waiting game can start and i hope you get your False negative resolved as soon as possible !\n","permalink":"https://vertho.tech/2025/02/04/tutorial-the-fastest-way-to-report-a-false-negative-in-defender-for-endpoint/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eEncountering a false negative during a customer engagement can be a critical issue. Recently, I faced a similar situation where a particular exploit went undetected. While I won’t delve into the specifics of the exploit, I want to highlight an efficient method to report false negatives promptly for resolution.\u003c/p\u003e\n\u003cp\u003eIn my recent experience, the false negative case was addressed within just 4 days of thorough investigations.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e⚠️ During my writing (25/12) , Microsoft updated their docs about “how to address Address false positives/negatives in Microsoft Defender for Endpoint” (12/01). I suggest to also read it. You can find it \u003ca href=\"https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-false-positives-negatives\" rel=\"noopener\"\u003ehere\u003c/a\u003e , it covers more use case then my blog.\u003c/p\u003e\n\u003c/blockquote\u003e","title":"Tutorial: The fastest way to report a False negative in Defender for Endpoint!"},{"content":"Lately, I’ve been doing a lot of Defender for Endpoint deployment/configuration troubleshooting, which prompted me to dust off my MDE-Troubleshooter. I noticed it was missing some new and improved configurations, so I decided to update it.\nWhat’s new:\n– Updates with the new supported Attack surface reduction rules\n– File hash computation check\n– Run as admin check\n– Option to download the Client Analyzer\n– AV Signature/intelligence updater\n– Overal performance improvements by using different threads\nDownload: https://lnkd.in/eDXbhKXF\nI’m eager to hear your ideas and suggestions! Connect with me on Twitter (@thomasvrhydn) or LinkedIn, and let’s collaborate to enhance MDE-Troubleshooter together.\n","permalink":"https://vertho.tech/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/","summary":"\u003cp\u003eLately, I’ve been doing a lot of Defender for Endpoint deployment/configuration troubleshooting, which prompted me to dust off my MDE-Troubleshooter. I noticed it was missing some new and improved configurations, so I decided to update it.\u003c/p\u003e\n\u003cp\u003eWhat’s new:\u003cbr\u003e\n– Updates with the new supported Attack surface reduction rules\u003cbr\u003e\n– File hash computation check\u003cbr\u003e\n– Run as admin check\u003cbr\u003e\n– Option to download the Client Analyzer\u003cbr\u003e\n– AV Signature/intelligence updater\u003cbr\u003e\n– Overal performance improvements by using different threads\u003c/p\u003e","title":"After 2 years a new release of MDE-Troubleshooter!"},{"content":"I’m thrilled to share the launch of the new eBook, “Demystifying Microsoft Defender for Servers” by James Agombar 🎉\nI had the pleasure of being a technical reviewer for this eBook, and I can confidently say it’s a valuable resource for anyone looking to enhance their knowledge of the product!\nThis comprehensive guide provides a deeper understanding of Microsoft Defender for Servers, covering its architecture, licensing, supported platforms, features, management options, and deployment strategies.\nhttps://lnkd.in/esMygBPi\n","permalink":"https://vertho.tech/2025/01/03/new-ebook-demystifying-microsoft-defender-for-servers-by-james-agombar/","summary":"\u003cp\u003eI’m thrilled to share the launch of the new eBook, “Demystifying Microsoft Defender for Servers” by \u003ca href=\"https://www.linkedin.com/in/jamesagombar/\" rel=\"noopener\"\u003eJames Agombar\u003c/a\u003e 🎉\u003c/p\u003e\n\u003cp\u003eI had the pleasure of being a technical reviewer for this eBook, and I can confidently say it’s a valuable resource for anyone looking to enhance their knowledge of the product!\u003c/p\u003e\n\u003cp\u003eThis comprehensive guide provides a deeper understanding of Microsoft Defender for Servers, covering its architecture, licensing, supported platforms, features, management options, and deployment strategies.\u003c/p\u003e","title":"New eBook, “Demystifying Microsoft Defender for Servers” by James Agombar"},{"content":"Intro This blog discusses a challenge I encountered with a client. They reached out for assistance in addressing issues during the deployment of Defender for Endpoint on Windows Server 2012 R2 and Windows Server 2016. Yes, despite being end-of-life (EOL), these operating systems are still in use.\nIf you’re only interested in the solution, skip ahead to the section titled The Solution.\nA special thanks to Rudy who helped me a lot !\nFollow him on twitter: Rudy Ooms | MVP 🇳🇱 (@Mister_MDM) / X\nLinkedin: (2) Rudy Ooms | LinkedIn\nBlogs: https://call4cloud.nl/\nThe start The first step I always take when troubleshooting onboarding issues is to check the Event Viewer. Right away, something unusual caught my attention. The Sense was trying to start ‘Sevice is starting’ and stuck in ‘start_pending’. After that another event was created which reported back ‘OOBE (Windows Welcome) has not yet completed’.\nSENSE event viewer: ‘Sevice is starting’\nOOBE (Windows Welcome) has not yet completed\nThe OOBE event was unfamiliar to me; I had never encountered it in other environments. I decided to focus on troubleshooting this first, as the client had already done extensive troubleshooting with Microsoft support without any success.\nWhat on earth does the OOBE have to do with starting the SENSE service or Defender for Endpoint? I had some background knowledge of the OOBE from my early days as an SCCM consultant, where I worked on building task sequences and customizing the OOBE experience. However, I was still perplexed—after all, I was already logged into the Windows Server 2012 R2, so you would expect the OOBE to have been completed by that point.\nAfter some research, I came across several Microsoft articles discussing the connection between OOBE and Defender for Endpoint. The first one I found was this:\n“Sensor doesn’t start because the Out-of-box experience (OOBE) or first user logon hasn’t been completed”\nAha there is link between them… but there was a additional note:\n“User Logon after OOBE is no longer required for SENSE service to start on the following or more recent Windows versions: Windows 10, version 1809 or Windows Server 2019, or Windows Server 2022 with April 22 2021 update rollup. Windows 10, version 1909 with April 2021 update rollup. Windows 10, version 2004/20H2 with April 28 2021 update rollup.”\nAlright, so it’s no longer a requirement on newer operating systems, but it must still be a requirement for Windows Server 2012 R2 and Windows Server 2016. The article also provided a solution for environments using SCCM, but since the client didn’t have an SCCM setup, that option wasn’t viable.\nThen I started thinking, how can I bypass the OOBE, restart it, or terminate it? I knew that you could rerun the OOBE using sysprep, but that would have a significant impact on the server, and I still wasn’t 100% certain that I was heading in the right direction with my troubleshooting…\nThe community for the HELP I asked the question to the community to see if there was a connection between the OOBE and the SENSE service, or if anyone else had encountered this issue. I quickly received a response from one of the Program Managers for Defender for Endpoint, who said he would ask it internally.\nCommunity question about the OOBE and MDE\nShortly after, I received a message from Rudy Ooms (Everything you need to know about Rudy Ooms), who decided to reverse engineer the SENSECM.dll files of the SENSE service to check for any references to the OOBE. Within 10 minutes, he hit the jackpot. Rudy found a reference to the OOBE:\nReference of the OOBE in the SENSE .dll\nHe also discovered a function that checks whether the OOBE had been completed. In the image below, you can see the function, and you’ll notice that the check is based on a registry key:\nReference to the validation key\nWhen I checked the value of the registry key on the device I was troubleshooting, it had the following value: ‘IMAGE_STATE_UNDEPLOYABLE’ .\nInteresting isn’t it. Now, back to the function. The function returns true when the value is ‘IMAGE_STATE_COMPLETE’. What if i just change the value on my troubleshooting server and then start the service or rerun the onboarding script? Will it be so easy?\nThe solution In this section i will explain the solution:\nChange the following reg key to:\nHKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\nValue: IMAGE_STATE_COMPLETE\nRerun the onboarding script:\nThat is it! It’s working, a very simple solution for a hard to troubleshoot issue. If you check the SENSE Events again, you will notice a event that says: ‘OOBE (Windows Welcome) is completed.\nOOBE is completed\n","permalink":"https://vertho.tech/2024/11/27/fix-sense-service-stuck-in-start_pending-on-ws2012r2-or-ws2016-check-oobe/","summary":"\u003ch2 id=\"intro\"\u003e\u003cstrong\u003eIntro\u003c/strong\u003e\u003c/h2\u003e\n\u003cp\u003eThis blog discusses a challenge I encountered with a client. They reached out for assistance in addressing issues during the deployment of Defender for Endpoint on Windows Server 2012 R2 and Windows Server 2016. Yes, despite being end-of-life (EOL), these operating systems are still in use.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIf you’re only interested in the solution, skip ahead to the section titled The Solution.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA special thanks to Rudy who helped me a lot !\u003c/p\u003e","title":"Fix: SENSE Service stuck in START_PENDING on WS2012R2 or WS2016? Check OOBE !"},{"content":"Intro I noticed that more and more clients are starting to use mixed license model for Defender for Servers. Previous you could only enable Defender for Server at the subscription level. Microsoft also noticed this and they made an option available to enable Defender for Servers at the resource level ! The ability to enable or disable Defender for Servers at the resource level is available exclusively via REST API. Is the blog I wil explain how to do this by leveraging the REST API.\nPrerequisites You need the following values to follow this walkthrough:\nSub id Full resource id Validate you current Defender for Server license model The easiest way in my opinion to validate you current Defender for Server license model is to use the REST API try it function from the Microsoft learn page. There are sure other options available but i want to keep it simple but effective.\nREST API Try It: Pricings – Get – REST API (Azure Defender for Cloud) | Microsoft Learn\nWhen you use this for the first time your need to authenticate, of course with credentials with the right permissions to handle the subscription/resource.\nAfter logging in you will see the following screen:\nFill in the parameters with the following values:\npricingName: “VirtualMachines” Scopeid : %your subscription id% In my test tenant i have Defender for Servers Plan 2 enabled on the subscription level:\nIf that is the same case in your own tenant you will receive the following response from the REST API:\nThe meaning of subPlan2 is that you have Defender for Server Plan 2 enabled on your subscription.\nHow to change Defender for Servers Plan on resource level Microsoft made a powershell script available that allows you to select machines based on Azure resource tags, or a resource group to configure them individually rather than using the same plan setting for all machines in a subscription. You can find it here.\nStart by downloading the script and execute it:\nLogin in with your credentials Enter your subscription ID You will receive the option to set pricing for all resources under a given Resource Group, or ‘TAG’ to set pricing for all resources with a given tagName and tagValue. In this case I choose Resource Group. Using tagging as option is also very useful option in bigger environments. When everything went successful you will receive feedback with the found resources: Press enter when you want to proceed. Choose Standard if you want to downgrade to Defender for Server P1. Choosing ‘Free’ will remove the Defender protection; ‘Standard’ will enable the ‘P1’ subplan; ‘Delete’ will remove any explicitly set configuration (the resource will inherit the parent’s configuration); ‘Read’ will read the current configuration\nThe script will process your input and provide feedback when everything is done\nValidate the change Now we can use the REST API Try It again to validate the change; use for the scopeID this time the full resource id. If everything when like expected you will receive the following response:\nYou will see that the subPlan is changed to P1. When we check the subPlan on subscription level it is still the same , with subPlan equals p2.\nThat’s it. You are now abel to change the Defender for Server Plan at resource level !\n","permalink":"https://vertho.tech/2024/03/06/tutorial-how-to-enable-disable-defender-for-servers-plans-at-resources-level/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eI noticed that more and more clients are starting to use mixed license model for Defender for Servers. Previous you could only enable Defender for Server at the subscription level. Microsoft also noticed this and they made an option available to enable Defender for Servers at the resource level ! The ability to enable or disable Defender for Servers at the resource level is available exclusively via REST API. Is the blog I wil explain how to do this by leveraging the REST API.\u003c/p\u003e","title":"Tutorial: How to enable/disable Defender for Servers Plans at resources level "},{"content":"Intro Microsoft published this summer new capabilities and enhancements for Defender for Endpoint on linux. In my opinion Defender for Endpoint on linux is a lot of times overlooked and the new features are a very good improvement to the performance of Defender for Endpoint on linux which deserve more exposure. In this blog i will talk about the new capabilities features and how you can benefit from them.\neBPF-based sensor for Defender for Endpoint (Preview) Microsoft Defender for Endpoint on Linux OS distributions uses AuditD framework to collect certain types of telemetry events which are captured by rules added to the /etc/audit/rules. In the past during my consultancy work i observed performance issues related to auditd. The most common issue i saw was high CPU resource consumption. After reporting the incident to Microsoft we were able to resolve this issue at my client environment. I’m speaking about issues we had 2 years ago. In the mean time Microsoft also updated their agent for linux with improvements and have a lot of great documented troubleshooting tips are now available on the Microsoft docs website which where not there 2 years ago. If you reading this and you are still having performance issues, i recommend to read the following docs:\nTroubleshoot performance issues for Microsoft Defender for Endpoint on Linux | Microsoft Learn\nMaybe you are thinking what has auditd have to do with eBPF? Well, now you can use eBPF as an alternative technology as a event provider. By Microsoft, it will deliver additional system ability and performance optimizations for all supported linux-based machines.\nHere are some of the key benefits of using eBPF as the primary supplementary event provider occurring to Microsoft:\nReduced system-wide auditd-related log noise Optimized system-wide event rules causing conflict between applications Reduced overhead for file event monitoring Improved event rate troughput Optimized performance for specific configurations If you are using the insider build of Defender for Endpoint agent the change to eBPF sensor will be automatically turned on if you have a version 101.23062.005 or later. If you’re running a production build and interested in evaluating the eBPF preview functionality like for instance in your testing environment, you can use the following mdatp config command:\nsudo mdatp config ebpf-supplementary-event-provider --value enabled Something to keep in mind, the eBPF sensor for Micorsoft Defender for Endpoint on linux is supported on the following distribution and kernel versions:\nLinux Distribution Distribution version Kernel Version Ubuntu 16.04 4.15.0 Fedora 33 5.8.15 CentOS 7.6 3.10.0-957 SLES 15 5.3.18-18.47 RHEL 7.6 3.10.0-957 Debian 9.0 4.19.0 Oracle Linux RHCK 7.9 3.10.10-1160 Oracle Linux UEK 7.9 5.4 You can validate the setup by running the mdatp health command. Before enabling eBPF, you will see events_subsystem with value ‘auditd’:\nAuditd Enabled\nAfter enabling eBPF, you must see the events_subsystem with value ‘eBPF’:\neBPF Enabled\nNEW response actions Device Isolation Previous you could only isolate a device that was running the Windows OS, because Microsoft wants to align the capabilities between Windows en Linux, they recently announced that this capability will also be available on Linux. if you are not familiar with device isolation, it will disconnect the possible compromised device from your environment network while maintaining connectivity to Defender for Endpoint service so you can still do you investigation.\nIf you want to isolate an endpoint you can do this from the portal or via API. Side note: the action is not currently available for Live response on Linux devices.\nFrom the M365 defender protal navigate to the device details and select ‘Isolate Deivce’ from the drop-down list.\nIsolate Device\nIf you want to use the API, you can create a HTTP POST request:\nPOST https://api.securitycenter.microsoft.com/api/machines/{id}/isolate { \u0026#34;Comment\u0026#34;: \u0026#34;Isolate machine due to alert 1234\u0026#34;, \u0026#34;IsolationType\u0026#34;: \u0026#34;Full\u0026#34; } When you trigger the action, the MDE agent on your linux endpoint will receive a command to run the isolation script. The isolation script will configure Linux firewall by using the iptables command both for ipv4 and ipV6. On my endpoint it looked like this:\nYou can always release your Endpoint when your are done investigating and the risk is mitigated:\nRelease device from isolation\nRun Antivirus Scan In the past , if you want to check if there is no malware stored on the Linux endpoint you couldn’t run Scan from the M365 defender portal and you need to it manually on the endpoint. This is history, from now on you can run a scan remotely, both quick scan or a full scan, from the M365 defender portal or API.\nFrom the portal, navigate to the device details and select ‘Run Antivirus Scan’ from the drop-down list:\nYou will get the option the choose your scantype, quick or full scan.\nIf you want to use the API: you can create a HTTP POST request:\nPOST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/runAntiVirusScan { \u0026#34;Comment\u0026#34;: \u0026#34;Check machine for viruses due to alert 3212\u0026#34;, \u0026#34;ScanType\u0026#34;: \u0026#34;Full\u0026#34; } Alerts will be created when the Defender for Endpoint scan detects malware on the endpoint.\nA record will be logged into the Action Center:\nM365 Defender Action Center\nThe progress cannot be followed remotely. You can still do this locally on the endpoint by looking in the following logs file on the endpoint for investigations:\n/var/log/microsoft/Microsoft_defender_enterprise.log /var/log/microsoft/Microsoft_defender_ir.log Security Configuration natively in Defender for Endpoint (Preview) Overview of the management solutions for MDE\nThis was one of biggest announcement Microsoft made and will make the security configuration management managed on your linux endpoints a lot easier. Previous you needed to create a configuration file and deploy the file with your desired automation tool. From now on you can use the M365 defender portal to create your linux policy and deploy it to your endpoint. In one of my previous blogs, I took a deep dive on the process behind it. If you interested to read this , you can find it here. You will learn how the devices get onboarded and how the policies get applied. If you want to get started with the new capability , i suggest the following Microsoft documentation.\nReference:\nNow in Public Preview: Device isolation and AV scanning for Linux and macOS in Microsoft Defender for Endpoint\nNow in Public Preview: Device isolation and AV scanning for Linux and macOS in Microsoft Defender for Endpoint\n","permalink":"https://vertho.tech/2023/08/28/defender-for-endpoint-for-linux-new-capabilities-and-enhancements/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eMicrosoft published this summer new capabilities and enhancements for Defender for Endpoint on linux. In my opinion Defender for Endpoint on linux is a lot of times overlooked and the new features are a very good improvement to the performance of Defender for Endpoint on linux which deserve more exposure. In this blog i will talk about the new capabilities features and how you can benefit from them.\u003c/p\u003e\n\u003ch2 id=\"ebpf-based-sensor-for-defender-for-endpoint-preview\"\u003eeBPF-based sensor for Defender for Endpoint (Preview)\u003c/h2\u003e\n\u003cp\u003eMicrosoft Defender for Endpoint on Linux OS distributions uses AuditD framework to collect certain types of telemetry events which are captured by rules added to the /etc/audit/rules. In the past during my consultancy work i observed performance issues related to auditd. The most common issue i saw was high CPU resource consumption. After reporting the incident to Microsoft we were able to resolve this issue at my client environment. I’m speaking about issues we had 2 years ago. In the mean time Microsoft also updated their agent for linux with improvements and have a lot of great documented troubleshooting tips are now available on the Microsoft docs website which where not there 2 years ago. If you reading this and you are still having performance issues, i recommend to read the following docs:\u003c/p\u003e","title":"Defender for Endpoint for Linux: new capabilities and enhancements"},{"content":"Intro This blog post is inspired by Rudy Ooms, who wrote a excellent write up about the behind the scenes of the MDE attach v2 process and security configuration on Windows endpoints. Which can be found here. A must read if you want a better understanding how MDE attach v2 is working…\nI was getting triggered during reading the explanation on what Rudy found about MDE attach v2 on his Windows endpoint. Is the same happening behind the scenes on Linux? Because Microsoft lately announced that the security management of Linux endpoints also was in public preview. In this blog I will show you my journey in debugging the solution on a Linux endpoint and trying to find a answer on the following questions:\nHow are already MDE onboarded devices getting enrolled into MDE attach v2? How does the devices get they policy defined in Intune? How are the policies getting applied? The start of the journey: enrollment in MDE attach v2 ⚠️ Note: This research is based on my own assumptions and isn’t official documented information from Microsoft. The possibility exist that the assumptions aren’t 100% correct.\nFirst, I wanted to have a look at the running processes on my Linux endpoint which was currently onboarded to MDE and enrolled in MDE attach v2 . I was looking for the process that was responsible for getting the policy deployed to the endpoint as a start. After searching for a tool i bumped into “strace”. With strace you can monitor syscall from the running processes on your linux endpoint. After analyzing the different possibilities of the tool I quickly realized that the tool wasn’t build for the goal i wanted to reach now. For example, the tool is more useful to monitor know processes, because by this time I still didn’t know which process I had to look at and running it for all processes gave me to many calls, which made it hard to capture they ones I was looking for.\nSo I took another approach. What if i start with monitoring the file system. I know that MDE for linux logs and stores a lot of configuration files in the following location: “/etc/opt/microsoft/mdatp/”. By monitoring this path i can see which process opens and write down some files, maybe the process responsible for MDE Attach v2 is also active here.\n‘Fatrace’ is the tool I’m going to start using. ‘fatrace’ reports file access events (Open, Read, Write, Close) from all running processes. So i started ‘fatrace’ and clicked the ‘policy sync’ option in M365 defender on the device that was onboarded into MDE:\nPolicy sync in M365 Defender\nAfter 2 minutes, I saw the following data popping up in my terminal:\nProve of both processes\nTwo very interesting processes were opening/writing to the path I was monitoring:\nwdavdaemon – Core daemon, uses fanotify for both antimalware and EDR purposes senseCM – Sense configuration management Already biased by the write up of Rudy, i was pretty sure i needed to monitor the senseCM. So I rebuild my Linux endpoint back to the state where it was only onboarded in MDE but not enrolled in MDE Attach v2.\nAfter this, the first thing i was thinking of was where does the process comes from. By digging in the binary files of mdatp I saw the binary senseCM was stored in the ‘/opt/microsoft/mdatp/sbin/’ folder. Microsoft supports MDE attach v2 linux only from a particular mdatp version. My wild guess is that older versions doesn’t have this binary included.\nI now can use ‘strace‘ tool because i know the process name but i quickly noticed that the senseCM is a self terminating process and being started by the wdavdaemon. You cannot start ‘strace’ on a process that is not yet running. This limitation made me create a bash script that looks for the process being created and after that capture the PID so i could use it with ‘strace’.\nCustom bash script to start strace when process starts\nSo how does the senseCM process getting started? It all begins with the wdavdaemon receiving an instruction from the cloud ‘EndpointConfigManagementEnrollCommand‘ which means the start of the enrollment. This instruction is sent during the tagging of your endpoint in M365 Defender if you use the selective option with the MDE-Management tag. This is followed by a managed authority check, which gave for my endpoint back the staus: ‘NotEnrolled‘.\nAuthority Check\nThis status trigged the wdavdaemon to initialize the binary SenseCM, which created process PID 9855 on my endpoint. Wdavdaemon is also the parent process of senseCM. A parameter json is delivered to the senseCM with the CommandType: ‘Enroll‘ with different parameters like OrgID, a challenge nonce, AadtenetID , etc.\nEnroll\nNow, it’s time for the senseCM to do his work and here we going to see some similar steps as on the Windows Endpoints. The senseCM will first check the state of the device by calling the GetRegistrationStatusV2.\nChecking senseCM with hex editor\nWe see here the Siam mode and senseCmModeSwitch set to 2. Which means MDE attach v2, we don’t see any signs of the v1. The function GetRegistrationSatusV2 provides the following return:\nDevice join state\nThey MEM (intune) enrollment will be called, which start with the calling the discovery with the url:\nCalling MEM service\nAgain no signs of v1 here, like you would have on the windows endpoints. When the discovery succeed the device receive the MemEnrollmentUrl and the MemUnenrollmentUrl:\nMEM enrollment URL\nTime to start the enrollment. The enrollment will be called also with the LeviathanToken, as Rudy described. The token is being used to authenticate to the ‘atpenroll’ service. I couldn’t capture the token in the HTTP request but i saw signs of it in the monitoring of the senseCM because the ‘LeviaThanTokenFetcher‘ is being called. You want more information about this token i will suggest to read Rudy separate section about it. The token is being stored in the binary ‘authentication_state’ under ‘/var/opt/microsoft/mdatp’.\nℹ️ Side not: a Leviathan is a sea serpent noted in theology and mythology.\nand after a couple off seconds we receive the ‘Enrollmnet succeeded’ status and what we also notice is a intuneDeviceId in the received results:\nIntune Device ID\nAfter checking intune we see the same id appearing:\nWe also see, what Microsoft calls a synthetic object, being created in Entra AD (AzureAD):\nThe senseCM process do a self-termination after this. That’s is, my endpoint is now onboarded into MDE Attavh V2. As you can see there isn’t much difference between the enrollment process on Linux and Windows. Time to have a look how the policy that you define in Intune/M365 Defender tenant gets applied on your Linux endpoint.\nHow does the policy get applied? The next question I was seeking an answer to was how the policy gets applied. I started again with the strace tool. This time monitoring both processes the wdavdeamon and senseCM (when its gets started). Next, I triggered a sync policy from the M365 Defender portal. Now lets the magic happen!\nIt’s begin with the mdavdaemon getting a notification from the cloud called ‘EndpointconfigurationCheckin‘. Currently the senseCM process isn’t running and the mdavdaemon will start the process and will provide a JSON argument with commandtype ‘Checkin‘ and some additional information.\nChecking-in JSON\nBefore the Check-in happens i saw that some preparation work is being done. The current policy which is applied on the endpoint will be checked and a checksum will be created of that policy. My guess is that it will be used to check the new policy with the old Policy later on. Afterwards , the Check-in will be called:\nCheck-in body\nAuthentication will happen again with the Leviathan token because i see signs of the ‘LeviathanTokenFetcher‘ being called. The senseCM receives a payload with a checksum in it. It will validated the checksum with the previous checksum, when there is a difference the new policy will be merged with the old policy, just as I thought.\nReceived payload\nDepending if there was already a policy applied, the following file will be modified mdatp_managed.json on the location ‘/etc/opt/microsoft/mdatp/managed/’ with the new policy. After, the new policy will be enforced. I also noticed that the policy checksum reports are also stored in the following location: ‘/etc/opt/microsoft/mdatp/managed/’.\nPolicy reports\nThe senseCM terminate after this and the operation is completed. So, that’s it. We found the answers on how the policies are getting applied. As a closing note i want to thank Rudy Ooms because his write up made finding out what is happening much easier. Again if you didn’t yet read it his write up , you can find it here .\nReference:\nMDE Attach V2 | MMP-C | Intune | Security Management | SENSE (call4cloud.nl)\nMDE Attach V2 | MMP-C | Intune | Security Management | SENSE (call4cloud.nl)\n","permalink":"https://vertho.tech/2023/08/04/microsoft-defender-for-endpoint-security-management-mde-attach-v2-on-linux-a-deep-dive/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eThis blog post is inspired by Rudy Ooms, who wrote a excellent write up about the behind the scenes of the MDE attach v2 process and security configuration on Windows endpoints. Which can be found \u003ca href=\"https://call4cloud.nl/2023/07/mmpc-mde-attach-v2-enroll-checkin-onboard/\" rel=\"noopener\"\u003ehere\u003c/a\u003e. A must read if you want a better understanding how MDE attach v2 is working…\u003c/p\u003e\n\u003cp\u003eI was getting triggered during reading the explanation on what Rudy found about MDE attach v2 on his Windows endpoint. Is the same happening behind the scenes on Linux? Because Microsoft lately announced that the security management of Linux endpoints also was in public preview. In this blog I will show you my journey in debugging the solution on a Linux endpoint and trying to find a answer on the following questions:\u003c/p\u003e","title":"Microsoft Defender for Endpoint security management (MDE Attach v2) on Linux : A deep dive"},{"content":"Intro Malicious actors actively search for machines with open management ports, such as RDP or SSH, to exploit. All of your virtual machines are potential targets for these attacks if you have those ports open. Once a VM is compromised, it serves as a entry point for the attackers to target other resources within your environment.\nMicrosoft Defender for Cloud provides a just-in-time (JIT) access feature that protects Azure virtual machines (VMs) against unauthorized network access. In the blog post i will talk about JIT and provide my experience with the product.\nHow JIT operates with network resources in Azure and AWS In Azure, you can block inbound traffic on specific ports, by enabling just-in-time VM access. Defender for Cloud ensures “deny all inbound traffic” rules exist for your selected ports in the network security group (NSG) and Azure Firewall rules. These rules restrict access to your Azure VMs’ management ports and defend them from attack.\nIf other rules already exist for the selected ports, then those existing rules take priority over the new “deny all inbound traffic” rules. If there are no existing rules on the selected ports, then the new rules take top priority in the NSG and Azure Firewall.\n⚠️ JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager. The Azure Firewall must be configured with Rules (Classic) and cannot use Firewall policies.\nIn AWS, by enabling JIT-access the relevant rules in the attached EC2 security groups, for the selected ports, are revoked which blocks inbound traffic on those specific ports.\nWhen a user requests access to a VM, Defender for Cloud checks that the user has Azure role-based access control (Azure RBAC) permissions for that VM. If the request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range), for the amount of time that was specified. In AWS, Defender for Cloud creates a new EC2 security group that allows inbound traffic to the specified ports. After the time has expired, Defender for Cloud restores the NSGs to their previous states. Connections that are already established are not interrupted.\nHow Defender for Cloud identifies which VMs should have JIT applied Microsoft created a fine diagram which shows the logic that Defender for Cloud applies when deciding how to categorize your supported VMs. For Azure:\nFor AWS:\nMultilayered protection for Azure virtual machine access If you already using Azure Bastion you can reduce the attack surface by adding JIT to your protection. If you want to leverage this, I suggest to read Wim Matthyssen blog about: ‘Azure Azure Bastion: Combine JIT with Azure Bastion’. Which can be found here.\nRecommendation Microsoft will also created a recommendation when Defender for Cloud finds a machine that can benefit from JIT, it adds that machine to the recommendation’s Unhealthy resources tab. You can find the recommendation by the name ‘Management ports of virtual machines should be protected with just-in-time network acccess control’.\nHow to start with JIT Availability Aspect Details Release state: General availability (GA) Supported VMs: screenshot VMs deployed through Azure Resource Managerscreenshot VMs deployed with classic deployment models screenshot VMs protected by Azure Firewalls on the same VNET as the VM screenshot VMs protected by Azure Firewalls controlled by Azure Firewall Managerscreenshot AWS EC2 instances (Preview) Clouds: screenshot Commercial cloudsscreenshot National (Azure Government, Azure China 21Vianet) screenshot Connected AWS accounts (preview) Permissions I recommend to create a custom roles that can work with JIT. This will create a least-privilegede role for users. To create a least-privileged role for users that need to request JIT access to a VM, and perform no other JIT operations, use the Set-JitLeastPrivilegedRole script from the Defender for Cloud GitHub community pages. Microsoft created a new overview of all the required permissions if you want to create custom roles:\nSource: Just-in-time virtual machine access in Microsoft Defender for Cloud | Microsoft Learn\nEnable JIT in Defender for Cloud From Defender for Cloud, you can enable and configure the JIT VM access.\nOpen the Workload protections and, in the advanced protections, select Just-in-time VM access. In the Not configured virtual machines, mark the VMs to protect with JIT and select Enable JIT on VMs.The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting: 22 – SSH 3389 – RDP 5985 – WinRM 5986 – WinRMTo customize the JIT access: Select Add. Select one of the ports in the list to edit it or enter other ports. For each port, you can set the: Protocol – The protocol that is allowed on this port when a request is approved Allowed source IPs – The IP ranges that are allowed on this port when a request is approved Maximum request time – The maximum time window during which a specific port can be opened Select OK. To save the port configuration, select Save. Edit the JIT configuration on a JIT-enabled VM using Defender for Cloud You have the ability to alter the just-in-time configuration of a virtual machine by introducing and setting up a fresh port to protect that particular VM, or by adjusting any other parameter associated with an existing secured port.\nTo edit the existing JIT rules for a VM:\nOpen the Workload protections and, in the advanced protections, select Just-in-time VM access. In the Configured virtual machines, right-click on a VM and select edit. In the JIT VM access configuration, you can either edit the list of port or select Add a new custom port. When you finish editing the ports, select Save. Request access to a JIT-enabled VM from Microsoft Defender for Cloud There are different methodes to request access to a JIT-enabled VM:\nBy using Defender for Cloud On your VM from Azure virtual machines Powershell REST API I will only demonstrate on your VM, details by the other methodes you can find here.\nTo request access from Azure virtual machines:\nIn the Azure portal, open the virtual machines pages. Select the VM to which you want to connect, and open the Connect page.Azure checks to see if JIT is enabled on that VM. If JIT isn’t enabled for the VM, you’ll be prompted to enable it. If JIT is enabled, select Request access to pass an access request with the requesting IP, time range, and ports that were configured for that VM. Auditing – Hunt with KQL If you are using a SIEM, like Sentinel, you can audit your JIT environment, to accomplish this I highly suggest to forward your Azure Activity logs and Resource logs to your SIEM. In the Azure Activity logs you can view who requested and initiated a JIT access to a Virtual machine. If you leverage Sentinel a table will be created in your log analytics workspace with the following name: ‘AzureActivity’. With KQL you can filter on OperationName with the value ‘Initiate JIT Network Access Policy’. Then you will receive all the JIT requests by caller. Like in the example below:\nThis can also very useful if your SOC needs to do investigations or can detect anomalies based for example on host IP address.\nSources:\nAzure Bastion: Combine JIT with Azure Bastion – Wim Matthyssen (wmatthyssen.com)\nJust-in-time virtual machine access in Microsoft Defender for Cloud | Microsoft Learn\nOverview of Azure platform logs – Azure Monitor | Microsoft Learn\n","permalink":"https://vertho.tech/2023/07/20/unleash-the-power-of-defender-plan-2-just-in-time-vm-access-part-4/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eMalicious actors actively search for machines with open management ports, such as RDP or SSH, to exploit. All of your virtual machines are potential targets for these attacks if you have those ports open. Once a VM is compromised, it serves as a entry point for the attackers to target other resources within your environment.\u003c/p\u003e\n\u003cp\u003eMicrosoft Defender for Cloud provides a just-in-time (JIT) access feature that protects Azure virtual machines (VMs) against unauthorized network access. In the blog post i will talk about JIT and provide my experience with the product.\u003c/p\u003e","title":"Unleash the power of defender plan 2: Just-in-time VM access – part 4"},{"content":"Background story During my consultancy work, I have received feedback from numerous clients indicating that they consistently encountered difficulties when attempting to troubleshoot issues with Defender for Endpoint on their local endpoints. They often found it a struggle to navigate through various locations, such as PowerShell for security configuration, the event viewer for log files, the registry for exclusions, and a separate section in the registry for tenant information.\nTherefore, I made the decision to develop a tool that could assist both myself and my clients in overcoming this struggle. Initially, I began by creating a graphical user interface (GUI) wrapper around the well-known PowerShell commands “Get-MpPreference” and “Get-MpComputerStatus.” However, I soon realized that additional features were necessary. This realization led to the birth of the MDE-Troubleshooter, a PowerShell script integrated with a GUI built using WPF. The tool is currently in version 1, and although I am not completely satisfied with the available features, I wanted to gather feedback from the community regarding its usefulness before proceeding with further development. I warmly welcome new ideas and features, and I am open to incorporating them into the tool. If you have any suggestions, please feel free to reach out to me on my social media platforms, such as Twitter (@thomasvrhydn) or LinkedIn.\nTHE MDE-troubleshooter tool\nFeatures The MDE-troubleshooter consist currently of the following feature:\nComputername and tenant ID Security configuration settings Attack surface reduction rules Check for latest Engine, platform and signature version with Microsoft (loading takes while) Quick access to the Performance Analyzer Show performance report when the performance analyzer has been run by the tool (saves locally the .ETL file) View Top 10 Files, Extensions, Process , Scans in seperated reports Show SENSE logs files Show Defender AV log files Show Exclusions Download link: https://github.com/ThomasVrhydn/MDE-troubleshooter/\nFeedback I warmly welcome new ideas and features, and I am open to incorporating them into the tool. If you have any suggestions, please feel free to reach out to me on my social media platforms, such as Twitter (@thomasvrhydn) or LinkedIn.\nReference\nhttps://github.com/ugurkocde/Intune/blob/main/Defender%20for%20Endpoint/MDE%20-%20Update%20Tool/MDE_Update_Tool.ps1\nhttps://github.com/directorcia/Office365/blob/master/win10-asr-get.ps1https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction\nhttps://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq\n","permalink":"https://vertho.tech/2023/06/30/tool-mde-troubleshooter-is-born/","summary":"\u003ch2 id=\"background-story\"\u003eBackground story\u003c/h2\u003e\n\u003cp\u003eDuring my consultancy work, I have received feedback from numerous clients indicating that they consistently encountered difficulties when attempting to troubleshoot issues with Defender for Endpoint on their local endpoints. They often found it a struggle to navigate through various locations, such as PowerShell for security configuration, the event viewer for log files, the registry for exclusions, and a separate section in the registry for tenant information.\u003c/p\u003e\n\u003cp\u003eTherefore, I made the decision to develop a tool that could assist both myself and my clients in overcoming this struggle. Initially, I began by creating a graphical user interface (GUI) wrapper around the well-known PowerShell commands “Get-MpPreference” and “Get-MpComputerStatus.” However, I soon realized that additional features were necessary. This realization led to the birth of the MDE-Troubleshooter, a PowerShell script integrated with a GUI built using WPF. The tool is currently in version 1, and although I am not completely satisfied with the available features, I wanted to gather feedback from the community regarding its usefulness before proceeding with further development. I warmly welcome new ideas and features, and I am open to incorporating them into the tool. If you have any suggestions, please feel free to reach out to me on my social media platforms, such as Twitter (@thomasvrhydn) or LinkedIn.\u003c/p\u003e","title":"Tool: MDE-Troubleshooter is born !"},{"content":"Intro When you want to investigate a endpoint that has indication of being comprised you might want to put the endpoint in Defender for Endpoint isolation mode. Isolation will disconnected the potential comprised endpoint from the network and will only allow connection to Defender for Endpoint Service. Depending on your OS level you can also choose to enable ‘Selective Isolation’.\nEnable Isolation mode\nThe problem? After you did you investigation and cleared the endpoint, you want to disable isolation mode and allow the device back on the network and in the business. You can do this with the same steps that you used for enable device isolation. By going to the M365 defender portal \u0026gt; Devices. Select the device and the three dots. You will have the option to ‘Release from isolation’ available. Normally the device will be able to reconnect to the network, but the reality has learned us that is not always the case.\nMicrosoft was aware of this issue and released today a solution for this ‘problem’ called ‘Forcibly release device from isolation’. Starting today you can download a script for every instance that isn’t responding after enable isolation mode. They made the script available though the M365 defender portal:\nRelease from isolation mode\nDownloading the script in only available if you are admin or you have the manage security settings in M365 Defender portal and the script is only valid for the specific device only and will expire in three days. Currently only supported on Windows endpoints and the following versions:\nWindows 10 21H2 and 22H2 with KB KB5023773 Windows 11 version 21H2, all editions with KB5023774 Windows 11 version 22H2, all editions with KB5023778 The script It triggered me to have a look at the content of the script. You cannot run the script as a local user because the script will add a registry blob in a key called ‘offlineCommand’ to the following location HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection”, that requires admin rights. The value of the reg keys contains timestamp info, device id info and tenant id etc. This confirm that the script is only for a specific device and will expire in three days. To investigate if the script successfully has run, you have a look in the event viewer under Applications and services logs \u0026gt; Microsoft-Windows-SENSE and look for the following text: “unisolation”.\nReference:\nTake response actions on a device in Microsoft Defender for Endpoint | Microsoft Learn\n","permalink":"https://vertho.tech/2023/06/23/your-isolated-device-stuck-in-defender-for-endpoint-isolation-mode-not-anymore/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eWhen you want to investigate a endpoint that has indication of being comprised you might want to put the endpoint in Defender for Endpoint isolation mode. Isolation will disconnected the potential comprised endpoint from the network and will only allow connection to Defender for Endpoint Service. Depending on your OS level you can also choose to enable ‘Selective Isolation’.\u003c/p\u003e\n\u003cp\u003e\u003cimg alt=\"Enable Isolation mode\" loading=\"lazy\" src=\"/2023/06/23/your-isolated-device-stuck-in-defender-for-endpoint-isolation-mode-not-anymore/image-21.png\"\u003e\u003c/p\u003e\n\u003cp\u003eEnable Isolation mode\u003c/p\u003e\n\u003ch2 id=\"the-problem\"\u003eThe problem?\u003c/h2\u003e\n\u003cp\u003eAfter you did you investigation and cleared the endpoint, you want to disable isolation mode and allow the device back on the network and in the business. You can do this with the same steps that you used for enable device isolation. By going to the M365 defender portal \u0026gt; Devices. Select the device and the three dots. You will have the option to ‘Release from isolation’ available. Normally the device will be able to reconnect to the network, but the reality has learned us that is not always the case.\u003c/p\u003e","title":"Your isolated device stuck in Defender for Endpoint Isolation mode , not anymore !"},{"content":"*UPDATE 17/07/2023* Added extra information about system labels\nIntro Microsoft is doing a very good job at listening to their customers, partners and MVP’s lately. One of the highly requested feature was to simplify the requirements for their MDE settings management (AKA ‘MDE Attach’) . But that’s not all, more exciting news will be announced soon. So stay tuned !\nWhats New? MDE Settings Management (AKA “MDE Attach”) was made Generally Available in May 2022 for Windows Operating Systems. Microsoft decided to simplify its AAD-registration component by relying on a lightweight ‘synthetic’ registration.\nIn the current version of MDE Security Configuration Management, (AKA “MDE Attach V1”), devices leveraging this feature require to be fully registered to Azure AD in order to be managed. The new process Microsoft is introducing (AKA “MDE Attach V2”) will not require this anymore. Instead, the lightweight ‘synthetic’ registration process will create a ‘placeholder’ identity for a device in the AAD tenant that is affiliated to the MDE tenant. Thanks to this object in the Azure directory, devices can be grouped and targeted with policies – despite not being fully registered to the Azure AD.\nIf a device is in scope for MDE Attach V2 and already has an Azure AD identity (fully registered), Microsoft will not create a duplicate entry in Azure AD. The existing identity will be leveraged for targeting security settings.\nMigration impact Customers already using this functionality will seamlessly transition to the updated infrastructure with no impact for their existing Windows devices managed by Defender for Endpoint that are using this functionality. Endpoint security policies will continue to apply as expected. Additionally, there will be no changes to the device, its identity, or registration type. Any new devices enrolled into security settings management for Defender for Endpoint will use the updated infrastructure.\n⚠️ Important: If a Windows device was managed by Defender for Endpoint via security settings management for Defender for Endpoint but was unable to enroll due to not being Azure AD joined or Hybrid Azure AD joined (like domain controllers), these devices will now succeed enrollment and policies targeted to the device will apply. Once enrolled, the device will appear in the device lists for Microsoft 365 Defender, Microsoft Intune, and Azure AD portals. Note that while the device won’t be fully registered with Azure AD it’ll still count as one device object.\n⚠️ To filter for devices that were previously unable to enroll in Defender for Endpoint due to not meeting the Azure AD join or Hybrid Azure AD join pre-requisite, navigate to the Microsoft 365 Defender portal \u0026gt; Devices list and filter by enrollment status. Since these devices are still not fully registered, they’ll show the device attributes where MDM = Intune and Join Type = Blank. With the new release, these will begin to successfully enroll.\nEnabling the MDE settings management “V2” Prerequisites Supported Operating Systems\nWindows OS:\n▪ Windows 10 Professional/Enterprise (from KB5006738)\n▪ Windows 11 Professional/Enterprise\n▪ Windows Server 2012 R2 with Microsoft Defender for Down-Level Devices*\n▪ Windows Server 2016 with Microsoft Defender for Down-Level Devices*\n▪ Windows Server 2019 (with KB5006744)\n▪ Windows Server 2022 (with KB5006745)\n*Down level servers will be supported by MDE Attach starting June 1st via the Windows Update\n(KB5005292 containing Sense version 10.8295.22621.1023).\nUser Permissions In Microsoft Defender for Endpoint portal, as a security admin, you’ll need at minimum permissions to view/edit security settings (“Manage security settings in Security Center”). In the Intune/Microsoft Endpoint Manager (MEM) portal, request for your IT administrator to grant you (security admin) with the Microsoft Endpoint Manager’s Endpoint Security Manager built-in RBAC role.\nConfigure M365D tenant If you are using MDE Attach V1 already then you don’t have to configure anything new. Otherwise, you need to follow the steps below to enable the MDE Settings management V2.\nWhile onboarding your Windows endpoint to MDE, make sure they are also in scope for MDE attach, by going to the “Enforcement Scope” section of the M365D portal. I recommend to initially test the feature only on tagged devices (by adding the “MDE-Management” tag on a device in the\nM365D portal).\nM365 Defender portal \u0026gt; Settings \u0026gt; Enforcement Scope\nSecurity setting management\nConfigure Intune Tenant In the Intune portal, select Endpoint security \u0026gt; Microsoft Defender for Endpoint, and set Allow\nMicrosoft Defender for Endpoint to enforce Endpoint Security Configurations to On.\nSelect Save\nEnble MDE integration for security Configuration\nWhen you set this option to On, all devices in the platform scope in Microsoft Defender for Endpoint that aren’t managed by Microsoft Endpoint Manager will qualify to onboard Microsoft Defender for Endpoint.\nCreate AAD group After devices onboard to Defender for Endpoint, you’ll need to create device groups to support\ndeployment of policy for Microsoft Defender for Endpoint. To identify devices that have enrolled with\nMicrosoft Defender for Endpoint but aren’t managed by Intune or Configuration Manager:\nSign in to Microsoft Endpoint Manager admin center. Go to Devices \u0026gt; All devices, and then select the column Managed by to sort the view of devices. Devices that onboard to Microsoft Defender for Endpoint but aren’t managed by Intune display Microsoft Defender for Endpoint in the Managed by column. These are the devices that can receive policies via MDE-attach. ( systemlables property containing the ‘MDEmanaged’ value’ ) You can create groups for these devices in Azure AD or from within the Microsoft Endpoint\nManager admin center *UPDATE 17/07/2023*\nThe V2 mechanism will not support the System Labels (“MDEJoined” and “MDEManaged”) which were previously supported. Action Item: If you haven’t created dynamic AAD groups based on these system labels, please ignore the steps below. If you did create dynamic groups based on these, Microsoft recommendation is to review your AAD groups:\nMicrosoft recommend dynamically grouping based on device’s OS type and not using the management channel as a grouping criteria. Note that you can now also dynamically group servers in AAD. (less preferred) If you still intend to dynamically group devices in Azure AD based on the management channel, Microsoft recommend using the “Management Type” = “MicrosoftSense” attribute instead of the “MDEManaged” system label (less preferred) use the supported “MDEManaged” system label Troubleshooting TIPS Enrollment issues In the M365D device inventory, confirm that the device is using MDE-attach by checking its\nstatus in the “Managed By” column. This is available also available in the device side panel or\ndevice page and should consistently indicate Managed By “MDE”. In the device side panel or device, you can also confirm it’s successfully enrolled by checking the device’s ‘MDE Enrollment status’ is “Success” Managed by and MDE Enrollment status\nIn the Intune portal, search for the device name in the All Devices page. The device should\nappear here as well with the Managed By column field set to “MDE”: Managed by MDE\nIn the Azure AD portal you will see the join Type blank and MDM: Microsoft intune Blank Join type\nSources:\n*Update to enrollment pre-requisites for Windows devices managed by Defender for Endpoint with Intune – Microsoft Community Hub\nDan Levy – M365D CCP – MDEAttach V2 private preview*\n","permalink":"https://vertho.tech/2023/06/15/microsoft-defender-for-endpoint-settings-management-enhancements/","summary":"\u003cp\u003e*UPDATE 17/07/2023* Added extra information about system labels\u003c/p\u003e\n\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eMicrosoft is doing a very good job at listening to their customers, partners and MVP’s lately. One of the highly requested feature was to simplify the requirements for their MDE settings management (AKA ‘MDE Attach’) . But that’s not all, more exciting news will be announced soon. So stay tuned !\u003c/p\u003e\n\u003ch2 id=\"whats-new\"\u003eWhats New?\u003c/h2\u003e\n\u003cp\u003eMDE Settings Management (AKA “MDE Attach”) was made Generally Available in May 2022 for Windows Operating Systems. Microsoft decided to simplify its AAD-registration component by relying on a lightweight ‘synthetic’ registration.\u003c/p\u003e","title":"Microsoft Defender for Endpoint settings management: Enhancements"},{"content":"Intro Welcome to part three of the blog series on Unleach the power of Defender for Servers Plan 2! In our previous blog, we explored how to start implementing Adaptive Application control. In part 3, we’ll dive into the concept of agentless scanning, which is included in Defender for Cloud Plan 2. We’ll explore what agentless scanning is, how it works, and how to get started implementing this tool for securing your cloud environment. By the end of this post, you’ll have a solid understanding of what agentless scanning is.\nWhat is Agent less scanning Agentless scanning for virtual machines (VMs) doesn’t require any installation, it utilizes cloud APIs for data collection. Defender for Cloud captures snapshots of VM disks and performs a offline analysis of the operating system configuration and file system contained within the snapshot which leverage Microsoft Defender Vulnerability Management in the backend. Because the scanning process is offline analysis, it doesn’t have any impact on the actual workload.\nThis copied snapshot remains within the original compute region of the VM and each VM is scanned every 24 hours.\nOnce the required data is collected from the disk, the copied snapshot is immediately deleted, and the (meta)data is sent to Microsoft engines for analysis of potential threats and configuration gaps. Since the scanning process is an out-of-band analysis of snapshots, it doesn’t impact the actual workloads and isn’t visible by the guest operating system.\nAgentless scanning protects disk snapshots according to Microsoft’s security standards. To ensure VM snapshots are private and secure during the analysis process, some of the measures taken by Microsoft are:\nData is encrypted at rest and in-transit. Snapshots are immediately deleted when the analysis process is complete. Snapshots remain within their original AWS or Azure region. EC2 snapshots aren’t copied to Azure. Isolation of environments per customer account/subscription. Only metadata containing scan results is sent outside the isolated scanning environment. All operations are audited. The scanning environment in which disk analysis is conducted is regional, volatile, isolated, and highly secure according to Microsoft. Disk snapshots and any data unrelated to the scan are not stored for any longer than necessary to gather the metadata, usually only a few minutes.\nAgentless scanning is included in Defender Cloud Security Posture Management (CSPM) and Defender for Servers P2 plans, agentless scanning is enabled on by default.\nIt’s currently only available for:\nAzure Standard VMs Virtual machine scale set – Flex AWS EC2 Auto Scale instance When enabling this feature you also need to keep in mind your Encryption active on your VM. Unencrypted and Encrypted with managed disks using Azure Storage Encryption with PMK is only supported for Azure VMs. For AWS, encrypted and encrypted with PML/CMK is supported.\nCompatibility with agent-based vulnerability assessment solutions Defender for Cloud already supports different agent-based vulnerability scans, including Microsoft Defender Vulnerability Management, BYOL and Qualys. Agentless scanning extends the visibility of Defender for Cloud to reach more devices which currently don’t have a vulnerability agent installed.\nI created the following flow chart to understand the compatibility with agent-based vulnerability assessment solutions.\nEnabling agentless scanning for machines When you enable Defender Cloud Security Posture Management (CSPM) or Defender for Servers P2, agentless scanning is enabled on by default.\nIf you have Defender for Servers P2 already enabled and agentless scanning is turned off, you need to turn on agentless scanning manually.\nAgentless vulnerability assessment on Azure To enable agentless vulnerability assessment on Azure:\nFrom Defender for Cloud’s menu, open Environment settings. Select the relevant subscription. Select Settings \u0026amp; monitoring. In the settings pane, turn on Agentless scanning for machines. Agentless vulnerability assessment on AWS From Defender for Cloud’s menu, open Environment settings. Select the relevant account. Select Settings, turn on Agentless scanning for machines. Select Save and Next: Configure Access. Download the CloudFormation template. Using the downloaded CloudFormation template, create the stack in AWS as instructed on screen. If you’re onboarding a management account, you’ll need to run the CloudFormation template both as Stack and as StackSet. Connectors will be created for the member accounts up to 24 hours after the onboarding. Select Next: Review and generate. Select Update. Exclude machines from scanning Agentless scanning applies to all of the eligible machines in the subscription. To prevent specific machines from being scanned, you can exclude machines from agentless scanning based on your pre-existing environment tags. When Defender for Cloud performs the continuous discovery for machines, excluded machines are skipped.\nTo configure machines for exclusion:\nFrom Defender for Cloud’s menu, open Environment settings. Select the relevant subscription or multicloud connector. For either the Defender Cloud Security Posture Management (CSPM) or Defender for Servers P2 plan, select Settings. For agentless scanning, select Edit configuration. Enter the tag name and value that applies to the machines that you want to exempt. You can enter multiple tag:value pairs. Select Save to apply the changes. Deploy by using Azure policy If you want to enable Agentless scanning on all your subscription and subscriptions made in the future I would advise to enable this feature with Azure Policy. They ARM template can be found here.\nYou will need to have the Object id of the Microsoft Defender for Cloud Scanner Resource provider, which is unique for every Azure AD. You can find the ID in Azure AD under Enterprise applications. Don’t forget to change the filter to ‘All applications’.\nIn the next couple of weeks I will create a separate blog how to deploy all the support Vulnerability managed solution in defender for cloud with Azure Policy.\nView and remediate findings There are different solutions available to review your findings in Defender for Cloud. In this section I will describe the following presentations:\nBy using recommendations By using a workbook By using the Azure Resource Graph Recommendations To view vulnerability assessment findings (from all of your configured scanners) and remediate identified vulnerabilities:\nFrom Defender for Cloud’s menu, open the Recommendations page. Select the recommendation Machines should have vulnerability findings resolved. Defender for Cloud shows you all the findings for all VMs in the currently selected subscriptions. The findings are ordered by severity. To filter the findings by a specific VM, open the “Affected resources” section and click the VM that interests you. Or you can select a VM from the resource health view, and view all relevant recommendations for that resource. Defender for Cloud shows the findings for that VM, ordered by severity. To learn more about a specific vulnerability, select it. The details pane that appears contains extensive information about the vulnerability, including: Links to all relevant CVEs (where available) Remediation steps Any additional reference pages To remediate a finding, follow the remediation steps from this details pane. Disable findings If you have an organizational need to ignore a finding, rather than remediate it, you can optionally disable it. Disabled findings don’t impact your secure score or generate unwanted noise.\nWhen a finding matches the criteria you’ve defined in your disable rules, it won’t appear in the list of findings. Typical scenarios include:\nDisable findings with severity below medium Disable findings that are non-patchable Disable findings with CVSS score below 6.5 Disable findings with specific text in the security check or category (for example, “RedHat”, “CentOS Security Update for sudo”) Workbook: Vulnerabilities by CVE IDs Tom Janetscheck, Senior program manager at Microsoft, created a very useful workbook that i suggest to start using. It’s an interactive workbook which provides an overview of machines in your environment that are affected by open vulnerabilities with a focus on CVE IDs.\nThe workbook can be found here.\nAs you might notice the workbook would not show data directly from Agentless scanning but either Microsoft Defender Vulnerability Management, or the integrated Qualys VA scanner. Still i find it worth to mention it. Especially if you are combining agentless with agent based solutions.\nAzure Resource Graph To export vulnerability assessment results, you can leverage the Azure Resource Graph (ARG). This tool provides instant access to resource information across your cloud environments with filtering, grouping, and sorting capabilities. It’s a quick and efficient way to query information across Azure subscriptions programmatically or from within the Azure portal. Is also has a API available. Below you can find a query where you can look up the vulnerability based on source and CVE IDs:\nsecurityresources | where type == \u0026#34;microsoft.security/assessments/subassessments\u0026#34; | extend assessmentKey = extract(\u0026#34;.*assessments/(.+?)/.*\u0026#34;,1, id) | where assessmentKey == \u0026#34;1195afff-c881-495e-9bc5-1486211ae03f\u0026#34; | project Resource = tolower(extract(\u0026#34;([\\\\s\\\\S]*?)(/providers/Microsoft.Security.*)\u0026#34;,1,id)), ResourceGroup = trim_end(\u0026#34;/\u0026#34;,extract(\u0026#34;.*resourceGroups/(.+?)/\u0026#34;,0,id)), ResourceType = tolower(split(id,\u0026#34;/\u0026#34;).[6]), subscriptionId, status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), description = tostring(parse_json(properties).displayName), cve = parse_json(properties.additionalData).cve, SoftwareVendor = tostring(properties.additionalData.softwareVendor), SoftwareName = tostring(properties.additionalData.softwareName), SoftwareVersion = tostring(properties.additionalData.softwareVersion), Source = tostring(properties.additionalData.source), severityFilter = tostring(\u0026#34;\u0026#39;High\u0026#39;,\u0026#39;Medium\u0026#39;,\u0026#39;Low\u0026#39;\u0026#34;) | where status == \u0026#39;Unhealthy\u0026#39; | where Source == \u0026#34;Microsoft threat and vulnerability management\u0026#34; | mvexpand todynamic(cve) | extend severity = tostring(cve[\u0026#39;severity\u0026#39;]), publishedDate = todatetime(cve[\u0026#39;publishedDate\u0026#39;]), lastModifiedDate = todatetime(cve[\u0026#39;lastModifiedDate\u0026#39;]) | where severityFilter has severity | summarize affectedMachines = dcount(Resource) by CVEID = tostring(cve[\u0026#39;title\u0026#39;]), cvssScore = todouble(cve[\u0026#39;cvssScore\u0026#39;]), severity, description = tostring(cve[\u0026#39;description\u0026#39;]), format_datetime(publishedDate, \u0026#39;yyyy-MM-dd, hh:mm\u0026#39;), format_datetime(lastModifiedDate, \u0026#39;yyyy-MM-dd, hh:mm\u0026#39;), hasPublicExploit = tostring(cve[\u0026#39;hasPublicExploit\u0026#39;]), isExploitVerified = tostring(cve[\u0026#39;isExploitVerified\u0026#39;]), exploitabilityLevel = tostring(cve[\u0026#39;exploitabilityLevel\u0026#39;]) | order by cvssScore, affectedMachines There are two important fields to keep in mind. The first one is the assessmentKey with value “1195afff-c881-495e-9bc5-1486211ae03f”, This is the value for the security recommendation “Machines should have vulnerability finds resolved” . The other one is the Vulnerability agent source value. Here you can determine if you only want to see the results of one source or of all the sources. The value for Qualys is “Built-in Qualys vulnerability assessment”. The source value for findings founds by agentless scanning is Microsoft threat and vulnerability management.\nSources:\nExporting Vulnerability Assessment Results in Microsoft Defender for Cloud – Microsoft Community Hub\nMicrosoft-Defender-for-Cloud/Workbooks/CVE Dashboard at main · Azure/Microsoft-Defender-for-Cloud · GitHub\nSean Stark – CCP program for the Azure policy overview\n","permalink":"https://vertho.tech/2023/06/14/unleash-the-power-of-defender-for-servers-plan-2-agentless-scanning-part-3/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eWelcome to part three of the blog series on Unleach the power of Defender for Servers Plan 2! In our previous blog, we explored how to start implementing Adaptive Application control.  In part 3, we’ll dive into the concept of agentless scanning, which is included in Defender for Cloud Plan 2. We’ll explore what agentless scanning is, how it works, and how to get started implementing this tool for securing your cloud environment. By the end of this post, you’ll have a solid understanding of what agentless scanning is.\u003c/p\u003e","title":"Unleash the power of Defender for Servers Plan 2: Agentless scanning – part 3"},{"content":"Intro Up until now, onboarding non-Azure servers to Defender for Servers required Azure Arc as a mandatory pre-requisite. With this new release, Microsoft is introducing an additional direct onboarding path for non-Azure servers that does not require Azure Arc (making it optional rather than mandatory).\nWith this new onboarding capability, you can deploy the MDE agent directly to your non-Azure servers and seamlessly connect them to Defender for Servers. This option is ideal for customers who want to focus on core endpoint protection while utilizing the consumption-based licensing provided by Defender for Servers.\nThis new capability is currently only possible tenant wide and will have impact on newly and existing onboarded servers. All windows and Linux servers operating system supported by Defender for Endpoint are supported. This capability is created for On-premises servers and multicloud VMs (limited support).\nSetup and pre-requisites\nGood to know Before you begin there are some things which are good to know and will help you with deciding if you want to leverage this new capability.\nRequired permissions\nTo configure this setting, you need Subscription Owner (on the chosen subscription), and AAD Global Administrator or AAD Security Administrator\nPlan support\nDirect onboarding provides access to all Defender for Servers Plan 1 features. If you want to use Plan 2, not all features will work. This is because some features in Plan 2 still require the deployment of the Azure Monitor Agent, which is only available with Azure Arc on non-Azure machines. If you enable Plan 2 on your subscription, machines onboarded directly with Defender for Endpoint have access to all Defender for Servers Plan 1 features and the Defender Vulnerability Management Addon features included in Plan 2.\nOverview of the different onboarding capabilities\nMulti-cloud support\nYou can directly onboard VMs in AWS and GCP using the Defender for Endpoint agent. However, if you plan to simultaneously connect your AWS or GCP account to Defender for Servers using multicloud connectors, it’s currently still recommended by Microsoft to deploy Azure Arc.\nSimultaneous onboarding limited support\nDefender for Cloud makes a best effort to correlate servers onboarded using multiple billing methods. However, in certain server deployment use cases, there may be limitations where Defender for Cloud is unable to correlate your machines. This may result in overcharges on certain devices if direct onboarding is also enabled on your tenant. Microsoft created a good overview of the deployment use cases currently with this limitation:\nLocation Deployment use case All Windows Server (all versions) Azure VMs or Azure Arc machines already onboarded and billed by Defender for Servers via an Azure subscription or Log Analytics workspace, running the Defender for Endpoint agent without the MDE.Windows or MDE.Linux Azure extensions. For such machines, you can enable Defender for Cloud integration with Defender for Endpoint to deploy the extensions. On-premises (not running Azure Arc) Windows Server 2019: Servers already onboarded and billed by Defender for Servers P2 via the Log Analytics workspace Windows Server 2012, 2016: Servers running the Defender for Endpoint modern unified agent, and already billed by Defender for Servers P2 via the Log Analytics workspace AWS, GCP (not running Azure Arc) Windows Server 2019: Servers already onboarded and billed by Defender for Servers via multicloud connectors, Log Analytics workspace, or both. Windows Server 2012, 2016: AWS or GCP VMs using the modern unified Defender for Endpoint solution, already onboarded and billed by Defender for Servers via multicloud connectors, Log Analytics workspace, or both. Deployment use cases with current limitation\nHow to get started? Enabling direct onboarding\nGo to Defender for Cloud \u0026gt; Environment Settings \u0026gt; Direct onboarding. Switch the Direct onboarding toggle to On. Select the subscription you would like to use for servers onboarded directly with Defender for Endpoint. I will advise to use a separate subscription. This subscription is only used for licensing, billing, alerts and security insights but doesn’t provide server management. Select Save. Direct onboarding in the portal\nDeploying Defender for Endpoint on your non-Azure servers\nBefore you begin your non-Azure servers need to be onboarded in Defender for Cloud. You can use the same guidance as if you would not use the defender for cloud integration. Refer to the Defender for Endpoint onboarding guide for further instructions.\nMonitor the status\nAfter you enabled the direct onboarding on your tenant level, you non-Azure machines will create a object in Defender for Cloud. You can validate this by reviewing the Inventory and filter on resource type “Servers – Defender for Endpoint”\nInventory: new resource type\nRecommendation\nDefender for Cloud will also provide some recommendation for your onboarded machine as you can see in the example below:\nRecommendations in DFC\nAlerts\nWhen malware is detected on the devices , an alert will be created which will be available both in the Defender for Endpoint portal as in the Defender for Cloud portal:\nAlerts in DFC\nInstalled applications\nA list of installed applications will be available powered by Microsoft Treat and vulnerability Management.\nInstalled applications in DFC\nConclusion\nThis new onboarding capability is a nice welcomed solution. With this Microsoft created an answer for a requested solution by a lot of customers. But be aware that this is currently a tenant wide setting and it will have impact on already onboarded non-Azure servers (non Azure-ARC). If you have a mixed environment with different Defender for Servers Plans it is recommend in my opinion to work with different landing zones. I’m looking forward till more features gets supported.\nSources\nOnboard non-Azure machines with Defender for Endpoint | Microsoft Learn\nPrivate preview – Direct Onboarding with MDE to Defender for Servers without arc Private Preview\n","permalink":"https://vertho.tech/2023/06/05/direct-on-board-your-non-azure-servers-to-defender-for-cloud-without-azure-arc/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eUp until now, onboarding non-Azure servers to Defender for Servers required Azure Arc as a mandatory pre-requisite. With this new release, Microsoft is introducing an additional direct onboarding path for non-Azure servers that does not require Azure Arc (making it optional rather than mandatory).\u003c/p\u003e\n\u003cp\u003eWith this new onboarding capability, you can deploy the MDE agent directly to your non-Azure servers and seamlessly connect them to Defender for Servers. This option is ideal for customers who want to focus on core endpoint protection while utilizing the consumption-based licensing provided by Defender for Servers.\u003c/p\u003e","title":"Direct on board your non-Azure servers to defender for cloud WITHOUT Azure Arc"},{"content":"Welcome, this is the second part of the Defender for server P2 advanced protection series I will blog about. If you want to read the other parts they can be found here:\nPart 0 Part 1 The topic of this blog will be about how to start with adaptive application controls (ACC). Let’s begin with explaining high level what adaptive application controls is and later on we will dive into the technical configuration of this security feature.\nWhat is Adaptive application controls Adaptive applications controls is a security control designed to protect machines against malware and other untrusted software. It works by defining a list of applications that you allow to run on your machines hosted in Azure VM, Non-Azure machines or Azure Arc machines running either Windows or Linux operating systems. You don’t have to start with a blank allow list on paper, you can use Defender for Cloud machine learning capabilities to analyze the applications running on your servers and create a list of know-safe applications for you. It even looks for possibilities to group the different servers so the same policy can apply to multi servers.\nCurrently no enforcement options are available, when adaptive applications controls detect a application which is not in the know applications list it will create an alert in Defender for Cloud. This feature is available in commercial clouds, National (Azure Government , Azure China 21Vianet and Connected AWS accounts.\nIn the background it leverage AppLocker capabilities on windows devices to configure the allowed list in Audit mode only, which limits you to controlling applications only running on the system. Because it’s using Applocker you don’t have the chain of trust from the hardware to the kernel that Windows Defender Application Control(WADC) offers. In my opinion WDAC is much more powerful and versatile, but if you don’t have any experience the learning curve can be hard and ACC can be a good starting point. Additionally, you will have the benefit that you can audit your applications also on Linux machines. Especially if you want a simple to deploy and quick overview of what the impact will be if you start using application white listing security controls ACC is a good starting point.\nHow does it work: behind the scenes ℹ️ Disclaimer: Before I begin to explain how this work in more detail, the information I’m providing is all unofficial information. It’s all being gained by monitoring the product behavior. It can be that I’m missing some details but the bigger picture should be correct.\nFor windows devices: It all starts when you are deploying the Azure Monitor Agent. The AMA agent will also deploy additional required extensions to the device like the Azure Security Agent (ASA). The Azure Security Agent (ASA) gets deployment on the machine. Called ‘AzureSecurityWindowsAgent’ extension in the Azure. The ASA extension is responsible for enabling Applocker in Audit mode for Executable rules, Windows Installer rules, scripts rules. You can verify this in your Local Security Policy \u0026gt; Application Control Policies \u0026gt; Applocker Applocker start creating audit events of all the running applications. You can check this in the event viewer and the AMA agent will forward the events to your configured Log Analytics Workspace. You can hunt for them with eventID 8002 in the SecurityEvent table. Defender for Cloud will use machine learning to analyze the App Locker events in your workspace. For linux: It all starts when you are deploying the Azure Monitor Agent. The AMA agent will also deploy required additional extensions to the device like the Azure Security Agent (ASA). The Azure Security Agent (ASA) gets deployment on the machine. Called ‘AzureSecurityLinuxAgent’ extension in the Azure. The ASA extension is responsible for created rules in the audit deamon. Like you can see in the example below. Audit deamon configuration on Linux\nAudit deamon will create events and will store them in audit.log file. You can verify this on your machine on the follow location: “/var/log/audit/audit.log” Those events will be forwarded by the AMA agent to Defender for Cloud Defender for Cloud will used machine learning to analyze the events and will propose a recommendation How to start with adaptive application controls Design principals A short section on proposed design principals, my advice will be the following design principals:\nKeep it simple Pick your targets Have a well-defined process for application management and deployment. By keeping it simple I mean don’t try to push different AppLocker/ACC policies on the same device or mix the different application controls policies like AppLocker, WDAC, ADD. It’s good to know that ACC will not provide any know-safe application list if there already other AppLocker policies active coming from GPO or local security. Try to determine where ACC can be most used full or where it will be very difficult to manage. Domain controllers are a good target to start from because normally installing or running software other than the roles, admin tools and security applications aren’t necessary for domain controllers. A well-defined process for application management will make your implementation trouble-free because you will have an overview of the (approved) applications being deployed in your organization which make the process of creating on the allowed list less painless.\nRequirements License: Requires Microsoft defender for server plan 2\nRequired Roles and permissions:\nSecurity Reader and Reader roles can both view groups and the lists of know-safe applications Contributor and Security Admin roles can both edit groups and the lists of known-safe applications Required Agents: Azure Monitoring Agent or Log Analytics Agent\nConfigure adaptive application controls I would suggest to begin with reviewing the suggested allowlist provided by defender for cloud per group of servers.\nBefore you can use this it is good to know that defender for cloud needs at least two weeks of data to define the unique recommendations per group of servers and a working Azure Monitoring Agent or Log Analytics Agent sending events to the correct workspace.\nYou can find adaptive application controls by going to Defender for cloud \u0026gt; Workload protection \u0026gt; adaptive application controls. Under Recommend you will find a group of machines which Defender for Cloud recommend applying application controls for. In my environment, you see the group ‘REVIEWGROUP3-EU’:\nOverview of recommend audit settings\nWhen you click on the group, you can see all the recommend guidance to configure the Application control rule:\nSelect machines: All the machines Defender for cloud suggest to bundle\nSelected machine\nRecommend applications: here you see frequently used applications on the selected machines and highly recommended for defining in the allowed rules determined by the machine learning technology in DFC. In the example all the applications are defined by their publisher. You will see a path rule created when an application isn’t signed. You can also define which users this rule need to apply to. My advice is here is to apply it to all users or at least use the principle of least privilege. One of the negatives I don’t like is that you can’t see the file type from this policy. Later on I will demonstrate a solution to determine the file type of the rule. Currently three file types are supported for windows:\nExe MSI Script Recommended applications\nMore Applications: Applications that have been seen on the machines but are requires a review. You will also see a warning icon indicates that a specific application could be used by an adversary to bypass an Adaptive application control. You can always deselect an application recommendation if you don’t want it to be allowed.\nAdditional Applications\nWhen you are agree with the defined policy, you can click on Audit on the bottom of the page.\nMonitor your deployment I was wondering how fast the policy would kick in on a Window machine. I’m aware that Microsoft sends telemetry data of Applocker/WDAC events to your Defender for Endpoint tenant. I was hoping to see if you could see the audit of potentially blocked applications also from the telemetry data.\nBut this wasn’t the case. After enabling the ACC policy I could only see event data appearing about the policy being applied in the DeviceEvents table located under the actiontype ‘AppControlPolicyApplied’.\nMDE telemetry data\nThis telemetry data is created if the process (%SystemRoot%\\System32\\AppIdPolicyConverter.exe) started running on the machine which reads the new applocker XML rules and try to apply them. If you like to read more detail about this, I suggest to read this article.\nI didn’t find any more data that was related to ACC/Applocker in the tables. It also explains that Microsoft just create audit rules in applocker and allows every application to run for everyone. Otherwise we would see more telemetry data related to this. You can also verify if this is the case in the configuration of the Local Security Policy AppLocker.\nLocal Applocker properties\nAlerting Defender for Cloud will create an alert when you violate an adaptive application control policy. Within the alert you will receive more additional Information about the incident. For instance, related entities (Account ,Azure resource, file , file hash etc. ), general information with file or publisher detection logic.\nExample Alert\nAlert details\nConclusion Adaptive application controls is a security feature that could be a good starting point when you want to implement application white listing on your machines and you have minor experience with other solutions. It’s currently limited only to audit mode. If you would like to use a more versatile solution i would advise to have a look at Windows Application Control.\nI hope this was instructive. If you have any comments or questions you can always contact me on my socials ( @ThomasVrhydn ) or via the contact form.\nSources\nhttps://www.microsoftpressstore.com/articles/article.aspx?p=2228450\u0026seqNum=11\nhttps://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls\n","permalink":"https://vertho.tech/2023/05/17/advanced-protection-features-in-defender-for-servers-plan-2-adaptive-application-controls-part-2/","summary":"\u003cp\u003eWelcome, this is the second part of the Defender for server P2 advanced protection series I will blog about.  If you want to read the other parts they can be found here:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"/2023/04/07/advanced-protection-features-in-defender-for-servers-plan-2-the-intro-part-0/\"\u003ePart 0\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"/2023/04/19/advanced-protection-features-in-defender-for-servers-plan-2-file-integrity-monitoring-part-1/\"\u003ePart 1\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe topic of this blog will be about how to start with adaptive application controls (ACC). Let’s begin with explaining high level what adaptive application controls is and later on we will dive into the technical configuration of this security feature.\u003c/p\u003e","title":"Unleash the power of Defender for Servers Plan 2: Adaptive Application Controls – Part 2"},{"content":"Intro This blog will be about an issue I bumped into when deploying one of the enhanced protection features in defender for cloud. The enhanced feature, adaptive application control, requires the deployment of the Azure Monitor Agent. The Azure Monitoring Agent also installs additional extensions. One of those additional extensions is the Azure Security Agent (ASA) extension, which supports Endpoint Protection recommendations, fileless attack detection and adaptive application control. The ASA extension is by default automatically installed when the auto-provisioning is enabled for the Azure Monitoring Agent in Defender for Cloud. The ASA extension is also the reason I started this blog post because during my deployment the extension was only provisioned on one of my virtual machines. I had to figure out what was the reason behind this…\nSetup Three virtual machines with the following images:\nWindows Server 2019 Datacenter – x64 Gen2 (imageSKU name: 2019-datacenter-gensecond) Windows server 2019 Datacenter – x64 Gen1 (ImageSKU name: 2019-datacenter) Windows server 2022 Datacenter – x64 Gen2 (ImageSKU name: 2022-datacenter-g2) Note: Keep an eye on the imageSKU names because they will be important later on.\nDefender for Cloud:\nDefender for servers P2 was enabled on subscription and workspace level. Auto provisioning of the Azure Monitor Agent was configured Find the root cause After creating the virtual machines the auto provisioning from Defender for Cloud started kicking in. The AMA agent started to get deployed on the all three machines. I was expecting that the ASA extension will follow shortly after, but this was only the case on one of the three machines. The extension was only installed on the machine with the imageSKU “2019-datacenter”. I started to troubleshoot why this wasnt the case on the other machines by reviewing the local logs. After a while I quickly realized I didn’t yet found any sign of this extension even trying to get installed. The provisioning of the extension also wasn’t visible in azure portal on the resource level…\nVirtual machine without the ASA extension\nVirtual machine with the ASA extension\nI’m aware that they are other possibilities available to deploy the AMA agent with the ASA extension to your virtual machines, like with Azure Policy. You got the following policy initiative, current in preview, available in Azure called ‘Custom Defender for Cloud provisioning Azure Monitor agent’ which exist out of different other policies. One of those policies is the policy named ‘[Preview]: Configure supported Windows machines to automatically install the Azure Security agent’. With this policy we could install the ASA agent to the machines which are missing the ASA extension.\nI was wondering what was defined in the Azure Policy definition file… after reviewing the definition file I quickly found out what the root cause was of this ASA extension not deploying, if of course Microsoft is using the same definition file behind the scenes for the auto-provisioning feature in Defender for Cloud. In the definition file there is a part about the supported imagesSKU’s. When you have a look at the supported imageSKU you will see the following result:\n{ \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSKU\u0026#34;, \u0026#34;in\u0026#34;: [ \u0026#34;2008-R2-SP1\u0026#34;, \u0026#34;2008-R2-SP1-smalldisk\u0026#34;, \u0026#34;2012-Datacenter\u0026#34;, \u0026#34;2012-Datacenter-smalldisk\u0026#34;, \u0026#34;2012-R2-Datacenter\u0026#34;, \u0026#34;2012-R2-Datacenter-smalldisk\u0026#34;, \u0026#34;2016-Datacenter\u0026#34;, \u0026#34;2016-Datacenter-Server-Core\u0026#34;, \u0026#34;2016-Datacenter-Server-Core-smalldisk\u0026#34;, \u0026#34;2016-Datacenter-smalldisk\u0026#34;, \u0026#34;2016-Datacenter-with-Containers\u0026#34;, \u0026#34;2016-Datacenter-with-RDSH\u0026#34;, \u0026#34;2019-Datacenter\u0026#34;, \u0026#34;2019-Datacenter-Core\u0026#34;, \u0026#34;2019-Datacenter-Core-smalldisk\u0026#34;, \u0026#34;2019-Datacenter-Core-with-Containers\u0026#34;, \u0026#34;2019-Datacenter-Core-with-Containers-smalldisk\u0026#34;, \u0026#34;2019-Datacenter-smalldisk\u0026#34;, \u0026#34;2019-Datacenter-with-Containers\u0026#34;, \u0026#34;2019-Datacenter-with-Containers-smalldisk\u0026#34;, \u0026#34;2019-Datacenter-zhcn\u0026#34; ] } As you can see, only one of the three VM images that I used are supported. The last update of this Azure Policy is 30 september 2022 and still in preview. After contacting Program managers from Defender for Cloud, they told me that they are aware of this limitation…\nHow to work around the limitation By duplicating the policies we can modify the definition file of the policy by adding the other imageSKU values to the file or by creating a broader supported scope. I choose the last approach because otherwise it coould be that later on you need to modify the definition file again. To configure this follow the next steps:\nGo to Azure policy portal and on the sidebar choose Definitions. In the search bar search for ‘Azure Security Agent’. Policy – Microsoft Azure Select the policy: ‘[Preview]: Configure supported Windows machines to automatically install the Azure Security agent’ and on the right click on ‘Duplicate Definition. Choose a Definition location, give the Policy an name. Select a the Category: Use existing Modify the policy rule by going to line containing “field”: “Microsoft.Compute/imageSKU” Replace it with the following value: { \u0026#34;anyOf\u0026#34;: [ { \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSku\u0026#34;, \u0026#34;like\u0026#34;: \u0026#34;2008-R2-SP1*\u0026#34; }, { \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSku\u0026#34;, \u0026#34;like\u0026#34;: \u0026#34;2012-*\u0026#34; }, { \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSku\u0026#34;, \u0026#34;like\u0026#34;: \u0026#34;2016-*\u0026#34; }, { \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSku\u0026#34;, \u0026#34;like\u0026#34;: \u0026#34;2019-*\u0026#34; }, { \u0026#34;field\u0026#34;: \u0026#34;Microsoft.Compute/imageSku\u0026#34;, \u0026#34;like\u0026#34;: \u0026#34;2022-*\u0026#34; } ] } Click on Save Now you are done with creating the new policy and you can start using this custom Azure policy to deploy the ASA agent to all of your virtual machines and start using the advanced features that comes with Defender for Cloud !\n","permalink":"https://vertho.tech/2023/05/04/how-to-work-around-the-azure-security-agent-extension-not-deploying-by-default-on-the-latest-vm-windows-images-a-currently-know-limitation/","summary":"\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eThis blog will be about an issue I bumped into when deploying one of the enhanced protection features in defender for cloud. The enhanced feature, adaptive application control, requires the deployment of the Azure Monitor Agent. The Azure Monitoring Agent also installs additional extensions. One of those additional extensions is the Azure Security Agent (ASA) extension, which supports Endpoint Protection recommendations, fileless attack detection and adaptive application control. The ASA extension is by default automatically installed when the auto-provisioning is enabled for the Azure Monitoring Agent in Defender for Cloud. The ASA extension is also the reason I started this blog post because during my deployment the extension was only provisioned on one of my virtual machines. I had to figure out what was the reason behind this…\u003c/p\u003e","title":"How to work around the Azure Security Agent extension not deploying by default on the latest VM windows images, a currently know limitation…"},{"content":"\nIntro Welcome to part 1 of the blog series about enhanced protection features available in Defender for Servers Plan 2. Part 1 will be about the protection feature called File Integrity Monitoring (FIM) in Defender for cloud.\nIntro Welcome to part 1 of the blog series about enhanced protection features available in Defender for Servers Plan 2. Part 1 will be about the protection feature called File Integrity Monitoring (FIM) in Defender for cloud.\nWhat is FIM File Integrity Monitoring (FIM) is an ongoing process which gets you visibility into all of your sensitive files, detecting changes and tampering of critical system files or directories that would indicate an ongoing attack. Knowing if any of these files have been tampered with is critical to keep your infrastructure secure, helping you detect attacks at an early stage and investigate them afterwards. FIM studies your operating systems files, Windows registries, application software and linux system files for changes that might be suspicious such as:\nFile and registry key creation or removal File modifications (changes in file size, access control lists, and hash of the content) Registry modifications (changes in size, access control lists, type, and content) FIM uses the Azure Change tracking solution in the background to track and identify changes on your operating systems. Change tracking forwards the collected data to a Log Analytics workspace. Devices connected to the Log Analytics workspace can both use the Log Analytics agent or Azure Monitor Agent to collect data about changes.\nIn this blog I will only explain how to enable File Integrity monitoring when using the Azure Monitor agent, which is currently still in preview, because the Log Analytics Agent will be deprecated soon. The Azure Monitor Agent (AMA) collects data from devices according to data collection rules to define a list of files and registry to track. You can use the Microsoft default configuration of tracked files and registry keys but you can always edit the DCR to add, remove, or update the list tracked by FIM. Change Tracking is supported on all operating systems that meet AMA requirements.\nFor tracking changes in files on both Windows and Linux, Change Tracking uses MD5 hashes of the files. The feature uses the hashes to detect if changes have been made since the last inventory. The next table shows the data collection frequency for the types of changes supported by Change Tracking. For every type, the data snapshot of the current state is also refreshed at least every 24 hours.\nChange Type Frequency Windows registry 50 minutes Windows File 30 minutes Linux file 15 minutes Windows services Default: 30 minutes Linux daemons 5 minutes Windows software 30 minutes Linux software 5 minutes Limitations There are some limitation of Change tracking to keep in mind:\nRecursion for Windows registry tracking Network file systems Different installation methods *.exe files stored on Windows The Max File Size column and values are unused in the current implementation. If you are tracking file changes, it is limited to a file size of 5 MB or less. If the file size appears \u0026gt;1.25MB, then FileContentChecksum is incorrect due to memory constraints in the checksum calculation. If you try to collect more than 2500 files in a 30-minute collection cycle, Change Tracking and Inventory performance might be degraded. If network traffic is high, change records can take up to six hours to display. If you modify a configuration while a machine or server is shut down, it might post changes belonging to the previous configuration. Collecting Hotfix updates on Windows Server 2016 Core RS3 machines. Linux daemons might show a changed state even though no change has occurred. This issue arises because of the way the SvcRunLevels data in the Azure Monitor ConfigurationChange table is written. How to get started Maintaining an asset inventory is the first step in your FIM implementation process. You cannot secure what you can’t see, and thus, having a list of files and directories that are important for you is the very first best practice you must implement in your infrastructure.\nCreate and maintain a comprehensive list of the files and directories that need monitoring. These assets include system and configuration files, as well as files containing sensitive information. While many of these files will depend on the actual business use case, there are a common set of assets that you certainly want to be monitored. When you have your assets and list of files ready you can start with enabling FIM.\nℹ️ A word of caution here: Too big of a scope will cause too many alerts, and it can lead to too many false positives and alert fatigue, rendering your whole FIM untrustable and worthless.\nAvailability Aspect Details Release state Preview License Requires Microsoft Defender for Servers Plan 2 Required roles and permissions Owner Contributor Clouds screenshot Commercial clouds – Supported only in regions: australiaeast, australiasoutheast, canadacentral, centralindia, centralus, eastasia, eastus2euap, eastus, eastus2, francecentral, japaneast, koreacentral, northcentralus, northeurope, southcentralus, southeastasia, switzerlandnorth, uksouth, westcentralus, westeurope, westus, westus2 screenshot National (Azure Government, Azure China 21Vianet) screenshotAzure Arc enabled devices. screenshot Connected AWS accounts screenshot Connected GCP accounts Prerequisites To enable FIM on devices with AMA:\nEnable Defender for Servers Plan 2 on subscription and Log Analytics workspace level Install AMA on machines that you want to monitor Enable FIM with the Azure Monitor Agent There are different ways to enable FIM, you can enable the different components one by one or you can use the Secure score Recommendation. I would like to suggest to use the Recommendation.\nFrom Defender for Cloud’s sidebar, open the Recommendations page.\nSelect the ‘All recommendations’ tab and search for ‘File integrity monitoring should be enabled on machines‘ Select the machines on the unhealthy resources tab you would like to enable FIM on. Click on Fix Recommendation FIM\nThe Fix will do the following steps:\nInstalls the ChangeTracking-Windows or ChangeTracking-Linux extensions on the machines Generates a Data Collection Rule (DCR) for the subscription, named Microsoft-ChangeTracking-[subscriptionId]-default-dcr, that defines what files and registries should be monitored based on default settings. Creates a new Log Analytics workspace with the naming convention defaultWorkspace-[subscriptionId]-fim and with the default workspace settings. Note: if you use the default workspace make sure you enable defender for servers plan 2 on the workspace level.\n⛔ Warning: In some cases you would not like to forward the events to a default workspace created by Microsoft, for instance if you want to forward the events to your Sentinel workspace. In one of my previous blogs I explained how you can change the workspace destination of Data Collection Rules. Which you can find here.\nValidate your deployment \u0026amp; troubleshoot tips Don’t expect to see results directly , give it some time. In this section I will point to some ways to validate you configuration on the device and in the Azure Portal.\nIn the Azure portal the first thing you could check is if the ‘ChangeTracking-Windows’ extension is provisioned successfully for windows devices. For linux devices the extension name is ‘ChangeTracking-Linux’. You can check this by going to virtual machines resources. Select your virtual machine. In the sidepanel under settings you will see Extensions + applications as you see in the screenshot below:\nExtension: ChangeTracking-Windows\nWhen you navigate to the virtual machine, you will have in the sidepanel under Operations ‘Change Tracking’. If Change Tracking is configured correctly you will see the screen with the text ‘Change tracking with AMA’. If Change Tracking already detected some file changes you will see which file has been changed. In this example I created the file ‘boot.ini’ which is being monitored by Change tracking.\nChanges tracking with AMA\nAnother way you could check is, if the AMA agent is sending data to the Log Analytics workspace your configured in the previous steps. This can be done with the table ‘Heartbeat’ available in the logs of the log analytic workspace. Here you could see if the AMA agent is sending data correctly to the workspace. The table field ‘Solutions’ most contain ‘ChangeTracking’ as you can see in the screenshot below:\nSolutions: ChangeTracking\nOn the Windows devices you can check the following files:\nC:\\WindowsAzure\\Logs\\Plugins\\Microsoft.Azure.ChangeTrackingAndInventory.ChangeTracking-Windows\\2.8.1.0\\CommandExecution.txt\nCheck if the installation successfully completed C:\\WindowsAzure\\Logs\\Plugins\\Microsoft.Azure.ChangeTrackingAndInventory.ChangeTracking-Windows\\2.8.1.0\\cta_windows_agent.txt\nCheck if there are any Errors. /var/log/azure/Microsoft.Azure.ChangeTrackingAndInventory.ChangeTracking-Linux/CommandExecution.txt\nCheck if the installation successfully completed /var/log/azure/Microsoft.Azure.ChangeTrackingAndInventory.ChangeTracking-Linux/cta_linux_agent.txt\nCheck if there are any Errors The following Windows services needs to be in the ‘running state’ locally on the device:\nChange_tracking_agent_windows_amd64.exe Change_tracking_service.exe The following Linux services needs to be in the ‘running state’ locally on the device::\nCxp.service – Azure Change tracking Parent Daemon Detecting changes Default no alert will be created in Defender for Cloud when a change is being detected. There are only two ways you could check if a change happened:\nIn Defender for Cloud under workload protection and the File integrity Monitoring page The logs in the workspace hunting with KQL Azure portal In the Azure Portal you can validate if any changes happened via the File Integrity Monitoring page. Because we are using the Azure Monitor Agent you need to select the banner to see the results:\nAzure Monitoring Agent Banner\nFile Integrity monitoring\nLog hunting with KQL Using the logs available in the Log Analytics workspace will be very useful if you would like to detect the changes in like Microsoft Sentinel. Change tacking of important files could be a use case in your detection engineering process. You can use the table ‘ConfigurationChange’ to build you KQL query. This table contains a lot of interesting fields, for instance Acls, PreviousAcls, DateModified, FieldsChanged etc. A reference of this table can you find here.\nBelow you see an example which could be used:\nKQL query example\nEdit the list of your tracked files FIM for machines with Azure Monitor Agent uses Data Collection Rules (DCRs) to define the list of files and registry keys to track. Each subscription has a DCR for the machines in that subscription.\nFIM creates DCRs with a default configuration of tracked files and registry keys. You can edit the DCRs to add, remove, or update the list of files and registries that are tracked by FIM.\nTo edit the list of tracked files and registries:\nIn File integrity monitoring, select Data collection rules.\nYou can see each of the rules that were created for the subscriptions that you have access to. Select the DCR that you want to update for a subscription.\nEach file in the list of Windows registry keys, Windows files, and Linux files contains a definition for a file or registry key, including name, path, and other options. You can also set Enabled to False to untrack the file or registry key without removing the definition.\nLearn more about system file and registry key definitions. Select a file, and then add or edit the file or registry key definition. Select Add to save the changes. RECAP This blog discusses the importance of file integrity monitoring in protecting servers from cyber threats. I begin by explaining what file integrity monitoring is and how it works. Then I describe the benefits of file integrity monitoring, including detecting unauthorized changes to files and identifying potential security breaches.\nI provided a step-by-step guide on how to set up file integrity monitoring in Defender for Cloud with some additional troubleshooting tips and tricks. How you can detect changes by using the KQL query language and I ended with a guidance to change the list of your tracked files.\nI hope this was instructive. If you have any comments or concerts you can always contact me on my socials (see below) or via the contact form.\nSources:\nhttps://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/configurationchange\nhttps://learn.microsoft.com/en-us/azure/automation/change-tracking/enable-vms-monitoring-agent?tabs=singlevm\nhttps://learn.microsoft.com/en-us/azure/automation/change-tracking/overview-monitoring-agent\nhttps://sysdig.com/blog/file-integrity-monitoring/\n","permalink":"https://vertho.tech/2023/04/19/advanced-protection-features-in-defender-for-servers-plan-2-file-integrity-monitoring-part-1/","summary":"\u003cp\u003e\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2023/04/19/advanced-protection-features-in-defender-for-servers-plan-2-file-integrity-monitoring-part-1/image-19.png\"\u003e\u003c/p\u003e\n\u003ch2 id=\"intro\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eWelcome to part 1 of the blog series about enhanced protection features available in Defender for Servers Plan 2. Part 1 will be about  the protection feature called \u003cstrong\u003eFile Integrity Monitoring (FIM)\u003c/strong\u003e in Defender for cloud.\u003c/p\u003e\n\u003ch2 id=\"intro-1\"\u003eIntro\u003c/h2\u003e\n\u003cp\u003eWelcome to part 1 of the blog series about enhanced protection features available in Defender for Servers Plan 2. Part 1 will be about  the protection feature called \u003cstrong\u003eFile Integrity Monitoring (FIM)\u003c/strong\u003e in Defender for cloud.\u003c/p\u003e","title":"Unleash the power of Defender for Servers Plan 2: File integrity monitoring – Part 1"},{"content":"\nIntroduction I decided to start a blog series about the Advanced protection features which are included in the Defender for Servers Plan 2 provided by Microsoft Defender for Cloud. More and more companies are starting to use Defender for Servers but are uncertain which plan to choose for. With this blog series I would like to provide enhanced information about the Advanced protection features and a guidance how to get started with the different features. I run against a lot of caveats deploying those features and I happy to share this with the community!\nAvailable Blogs ( 01/08/2023 ) Part 1: Advanced protection features in Defender for Servers Plan 2: File integrity monitoring – Part 1\nPart 2: Advanced protection features in Defender for Servers Plan 2: Adaptive Application Controls – Part 2 – Vertho | Verheyden Thomas\nPart 3: Unleash the power of Defender for Servers Plan 2: Agentless scanning – part 3 – Vertho | Verheyden Thomas\nPart 4: Unleash the power of defender plan 2: Just-in-time VM access – part 4 – Vertho | Verheyden Thomas\nAdvanced protection features Defender for Server Plan 2 provides more extended detection and response capabilities compared to Plan 1. The features which are currently available are:\nThreat detection for network-level (agentless): Defender for Servers detects threats that are directed at the control plane on the network, including network-based detections for Azure virtual machines.\nAdaptive application controls: Adaptive application controls define allowlists of known safe applications for machines. To use this feature, Defender for Cloud must be enabled on the subscription.\nMicrosoft Defender Vulnerability Management (MDVM) Add-on: Enhance your vulnerability management program consolidated asset inventories, security baselines assessments, application block feature, and more.\nSecurity Policy and Regulatory Compliance: Customize a security policy for your subscription and also compare the configuration of your resources with requirements in industry standards, regulations, and benchmarks.\nJust-in-time virtual machine access: Just-in-time virtual machine access locks down machine ports to reduce the attack surface.\nAdaptive network hardening: Network hardening filters traffic to and from resources by using network security groups (NSGs) to improve your network security posture. Further improve security by hardening the NSG rules based on actual traffic patterns.\nFile integrity monitoring: File integrity monitoring examines files and registries for changes that might indicate an attack. A comparison method is used to determine whether suspicious modifications have been made to files.\nDocker host hardening: Assesses containers hosted on Linux machines running Docker containers, and then compares them with the Center for Internet Security (CIS) Docker Benchmark.\nNetwork map: Provides a geographical view of recommendations for hardening your network resources.\nAgentless scanning: Scans Azure virtual machines by using cloud APIs to collect data.\n**Qualys vulnerability assessment:**As an alternative to Defender Vulnerability Management, Defender for Cloud can deploy a Qualys scanner and display the findings.\n**Free data ingestion (500 MB) in workspaces:**Free data ingestion is available for specific data types. Data ingestion is calculated per node, per reported workspace, and per day. It’s available for every workspace that has a Security or AntiMalware solution installed.\nScope of the blog series My focus currently is on Adaptive Application Control, File integrity monitoring, Adaptive network hardening, Agentless scanning and the MDVM add-on. The capabilities in MDVM add-on are expanding rapidly and maybe it deserve a blog series on its own.I don’t know yet in which order I will provide the different parts of this blog series but the first part will be about File integrity monitoring and will be released in the next weeks. Stay tuned !\nIf you have any suggestion or feature that you would like to know more of you can always contact me on my social networks or via the contact button on my blog site.\nHappy reading !\n","permalink":"https://vertho.tech/2023/04/07/advanced-protection-features-in-defender-for-servers-plan-2-the-intro-part-0/","summary":"\u003cp\u003e\u003cimg alt=\"screenshot\" loading=\"lazy\" src=\"/2023/04/07/advanced-protection-features-in-defender-for-servers-plan-2-the-intro-part-0/image-8.png\"\u003e\u003c/p\u003e\n\u003ch2 id=\"introduction\"\u003eIntroduction\u003c/h2\u003e\n\u003cp\u003eI decided to start a blog series about the \u003cstrong\u003eAdvanced protection features\u003c/strong\u003e which are included in the \u003cstrong\u003eDefender for Servers Plan 2\u003c/strong\u003e provided by \u003cstrong\u003eMicrosoft Defender for Cloud\u003c/strong\u003e. More and more companies are starting to use Defender for Servers but are uncertain which plan to choose for. With this blog series I would like to provide enhanced information about the Advanced protection features and a guidance how to get started with the different features. I run against a lot of caveats deploying those features and I happy to share this with the community!\u003c/p\u003e","title":"Unleash the power of Defender for Servers Plan 2: The Intro – Part 0"},{"content":"Intro This post is inspired on different setups I saw while working with my clients. More and more clients are leveraging the Azure Monitoring Agent (AMA) and Data Collection Rules (DCR) to collect log data. I’ve noticed that clients sometimes are sending logs data to different Log Analytics Workspace (LAW), without them being aware. Most of the time this is because Azure will create default LAW workspaces without warning about it or they just misconfigured the Data Collection Rule.\nI would always advise to centralise your log data to one Log Analytics workspace especially if you are using Microsoft Sentinel. Centralizing log data will reduce the complexity of managing multiple workspaces and in querying data from them where possible. But because of compliance reason like having different region requirements, different tenants, split billing this isn’t always achievable.\nTo centralise the log data we need to modify the destination of the LAW in the DCR definition file. At the moment changing the destination of the LAW isn’t possible from the Azure portal. That’s why I’m writing this tutorial to describe how to edit the definition of Data Collection Rule that has been already provisioned using command lines tools\nPrerequisites Before you can start editing the Data Collection rule, there are some prerequisites that needs to be fulfilled:\nContributor rights on the Log Analytics workspace Permissions to create Data Collection Rule objects in the workspace Access to Azure Cloud Shell DCR resource id New LAW destination id Resource id Name Retrieve the definition file of DCR The first step will be retrieving the definition file of the Data Collection Rule you would like to edit. This can be done with Cloud Shell button in the Azure portal.\nCloud shell\nMake sure you set the Cloud Shell environment to Powershell\nPowershell environment\nExecute the following commands to retrieve the definition file and save it to a file. The definition file will be stored as a .JSON file. The command will place a HTTP GET call to retrieve the DCR definition file and format the JSON to a readable text.\n$ResourceId = \u0026#34;\u0026lt;ResourceId\u0026gt;\u0026#34; # Resource ID of the DCR to edit $FilePath = \u0026#34;\u0026lt;FilePath\u0026gt;\u0026#34; # Store DCR content in this file $DCR = Invoke-AzRestMethod -Path (\u0026#34;$ResourceId\u0026#34;+\u0026#34;?api-version=2021-09-01-preview\u0026#34;) -Method GET $DCR.Content | ConvertFrom-Json | ConvertTo-Json -Depth 20 | Out-File -FilePath $FilePath Edit the definition file The code editor supplied with the environment is a good tool to use. Alternatively you can download the file from the Cloud shell. You can find a explanation how to do that here.\ncode \u0026#34;Edit.dcr\u0026#34; Definition file\nScroll down in the editor and locate the line containing “Destinations” attribute. There you will see “workspaceResourceid“, “workspaceid“,”name” under “logAnalytics” . You need to modify the value of those lines with your new destination Log Analytics Workspace id, Resourceid and name. After you modified all the three values you can save the file in the editor.\nUpdate the DCR with the modified definition file Execute the following commands to load DCR content from the file and place HTTP call to update the DCR in the system. Replace \u0026lt;ResourceId\u0026gt; with DCR ResourceID and \u0026lt;FilePath\u0026gt; with the name of the file modified in the previous part of the tutorial. You can omit first two lines if you read and write to the DCR within the same PowerShell session.\nUpon succesfull , you will get the response with status code “200”, indicating that your DCR is now updated as in the example below:\nPUT request result\nValidate you modification As an Extra control check you navigate to your Data Collection Rule in the Azure portal and examine the definition file via the ‘JSON VIEW” function.\nData Collectio Rule in Azure portal\nPutting everything together Now, when we know how to read and update the content of a DCR, let’s put everything together into utility script, which can be used to perform both operations together. Save the the script as DCEEditor.ps1 .\nparam ([Parameter(Mandatory=$true)] $ResourceId) # get DCR content and put into a file $FilePath = \u0026#34;temp.dcr\u0026#34; $DCR = Invoke-AzRestMethod -Path (\u0026#34;$ResourceId\u0026#34;+\u0026#34;?api-version=2021-09-01-preview\u0026#34;) -Method GET $DCR.Content | ConvertFrom-Json | ConvertTo-Json -Depth 20 | Out-File $FilePath # Open DCR in code editor code $FilePath | Wait-Process #Wait for confirmation to apply changes $Output = Read-Host \u0026#34;Apply changes to DCR (Y/N)? \u0026#34; if (\u0026#34;Y\u0026#34; -eq $Output.toupper()) { #write DCR content back from the file $DCRContent = Get-Content $FilePath -Raw Invoke-AzRestMethod -Path (\u0026#34;$ResourceId\u0026#34;+\u0026#34;?api-version=2021-09-01-preview\u0026#34;) -Method PUT -Payload $DCRContent\t} #Delete temporary file Remove-Item $FilePath You can use this script for example if you want to modify the Data Collection Rule with Resource ID of /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/foo/providers/Microsoft.Insights/dataCollectionRules/tempDCR , this could be accomplished by running the follow command:\n.\\DCREditor.ps1 \u0026#34;/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/foo/providers/Microsoft.Insights/dataCollectionRules/bar\u0026#34; DCR content will open in embedded code editor. Once editing is complete, entering “Y” on script prompt will apply changes back to the DCR.\nSource:\nMicrosoft docs\n","permalink":"https://vertho.tech/2023/03/27/tutorial-change-the-workspace-destination-of-you-data-collection-rule/","summary":"\u003ch3 id=\"intro\"\u003eIntro\u003c/h3\u003e\n\u003cp\u003eThis post is inspired on different setups I saw while working with my clients. More and more clients are leveraging the Azure Monitoring Agent (AMA) and Data Collection Rules (DCR) to collect log data. I’ve noticed that clients sometimes are sending logs data to different Log Analytics Workspace (LAW), without them being aware. Most of the time this is because Azure will create default LAW workspaces without warning about it or they just misconfigured the Data Collection Rule.\u003c/p\u003e","title":"Tutorial: Change the workspace destination of your already provisioned Data Collection Rule used by the Azure Monitoring Agent"},{"content":"You can find my previous blog posts on my medium site.\nBlock the automated onboarding of mde without disabling the mde integration:\nhttps://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\n","permalink":"https://vertho.tech/2023/02/01/block-the-automated-onboarding-of-defender-for-endpoint-without-disabling-the-integration-in-defender-for-cloud/","summary":"\u003cp\u003e\u003cstrong\u003eYou can find my previous blog posts on my medium site.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eBlock the automated onboarding of mde without disabling the mde integration:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\" rel=\"noopener\"\u003ehttps://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\u003c/a\u003e\u003c/p\u003e","title":"Block the automated onboarding of Defender for Endpoint without disabling the integration in Defender for Cloud:"},{"content":"You can find my previous blog posts on my medium site.\nDefender for servers mde onboarding behind the scenes:\nhttps://medium.com/@vertho/defender-for-servers-mde-onboarding-behind-the-scenes-ffc328d31639\nBlock the automated onboarding of mde without disabling the mde integration:\nhttps://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\n🔗 View at Medium.com\n","permalink":"https://vertho.tech/2022/07/27/defender-for-servers-mde-onboarding-behind-the-scenes/","summary":"\u003cp\u003e\u003cstrong\u003eYou can find my previous blog posts on my medium site.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eDefender for servers mde onboarding behind the scenes:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://medium.com/@vertho/defender-for-servers-mde-onboarding-behind-the-scenes-ffc328d31639\" rel=\"noopener\"\u003ehttps://medium.com/@vertho/defender-for-servers-mde-onboarding-behind-the-scenes-ffc328d31639\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eBlock the automated onboarding of mde without disabling the mde integration:\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\" rel=\"noopener\"\u003ehttps://medium.com/@vertho/defender-for-servers-block-the-automated-onboarding-of-mde-without-disabling-the-mde-integration-bc9c2ac89552\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://medium.com/@vertho\" rel=\"noopener\"\u003e🔗 View at Medium.com\u003c/a\u003e\u003c/p\u003e","title":"Defender for servers: Defender for Endpoint onboarding behind the scenes"},{"content":"Welcome to my blog! My name is Thomas Verheyden, and I am a Security Architect based in Belgium.\nAfter completing my bachelor\u0026rsquo;s degree, I began my career in IT consultancy and worked my way up from support engineer to Security Architect. Over the past 16 years, I have worked with a variety of enterprise clients in different sectors, and for the last 9 years, I have been working as a freelance security consultant.\nWhat this blog is about The purpose of this blog is to share my experience and knowledge with advising, designing, and implementing different security solutions, particularly those related to Microsoft. My blog will provide readers with tips and tricks, as well as insight into the knowledge I\u0026rsquo;ve gained from working with different security solutions. I believe that my blog posts should add extra value and not be a copy of the Microsoft docs.\nGet in touch I\u0026rsquo;m always happy to discuss different topics related to security. You can reach me via:\nContact page: send me a message X (Twitter): @ThomasVrhydn Thanks for stopping by, and I hope you find my blog informative and helpful! ","permalink":"https://vertho.tech/about/","summary":"\u003cp\u003eWelcome to my blog! My name is \u003cstrong\u003eThomas Verheyden\u003c/strong\u003e, and I am a \u003cstrong\u003eSecurity Architect\u003c/strong\u003e based in Belgium.\u003c/p\u003e\n\u003cp\u003eAfter completing my bachelor\u0026rsquo;s degree, I began my career in IT consultancy and worked my way up from support engineer to Security Architect. Over the past 16 years, I have worked with a variety of enterprise clients in different sectors, and for the last 9 years, I have been working as a freelance security consultant.\u003c/p\u003e","title":"About"},{"content":"I\u0026rsquo;m always happy to discuss topics related to security, especially Microsoft Defender, Sentinel and Exposure Management.\nFeel free to reach out for:\nQuestions or feedback about one of my blog posts Speaking requests for your conference or user group (see my past events) Freelance security consulting: advice, design and implementation of Microsoft security solutions thomas.verheyden [at] vertho.tech @ThomasVrhydn I usually reply within a few days.\n","permalink":"https://vertho.tech/contact/","summary":"\u003cp\u003eI\u0026rsquo;m always happy to discuss topics related to security, especially Microsoft Defender, Sentinel and Exposure Management.\u003c/p\u003e\n\u003cp\u003eFeel free to reach out for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eQuestions or feedback\u003c/strong\u003e about one of my blog posts\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSpeaking requests\u003c/strong\u003e for your conference or user group (see my \u003ca href=\"/events/\"\u003epast events\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFreelance security consulting\u003c/strong\u003e: advice, design and implementation of Microsoft security solutions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cdiv class=\"contact-links\"\u003e\n  \u003ca class=\"contact-btn contact-btn-primary js-mail\" data-u=\"thomas.verheyden\" data-d=\"vertho.tech\" href=\"#\"\u003e\n    \u003csvg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"\u003e\u003crect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"2\"/\u003e\u003cpath d=\"M3 7l9 6 9-6\"/\u003e\u003c/svg\u003e\n    \u003cspan class=\"js-mail-text\"\u003ethomas.verheyden [at] vertho.tech\u003c/span\u003e\n  \u003c/a\u003e\n  \u003ca class=\"contact-btn\" href=\"https://twitter.com/ThomasVrhydn\" rel=\"noopener\"\u003e\n    \u003csvg viewBox=\"0 0 24 24\" fill=\"currentColor\" aria-hidden=\"true\"\u003e\u003cpath d=\"M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231 5.45-6.231Zm-1.161 17.52h1.833L7.084 4.126H5.117l11.966 15.644Z\"/\u003e\u003c/svg\u003e\n    \u003cspan\u003e@ThomasVrhydn\u003c/span\u003e\n  \u003c/a\u003e\n\u003c/div\u003e\n\u003cscript\u003e\n  document.querySelectorAll(\".js-mail\").forEach(function (a) {\n    var addr = a.dataset.u + \"@\" + a.dataset.d;\n    a.href = \"mailto:\" + addr;\n    a.querySelector(\".js-mail-text\").textContent = \"Send me an email\";\n    a.title = addr;\n  });\n\u003c/script\u003e\n\n\u003cp\u003eI usually reply within a few days.\u003c/p\u003e","title":"Contact"},{"content":"I regularly speak at conferences and user groups about Microsoft Security: Defender XDR, Exposure Management, Intune EPM and securing Microsoft 365.\nWant me to speak at your event or user group? Get in touch.\nAt a glance Date Event Session 09/10/2026 AppManagEvent 2026 From Admin to Standard user with Intune EPM: notes from the field 24/09/2026 Defender User Group From Uncertainty to Resolution, Faster: Troubleshooting Microsoft Defender for Endpoint 18/09/2026 Workplace Ninja Summit From Admin to Standard user with Microsoft EPM: notes from the field 17/09/2026 Workplace Ninja Summit The EDR Didn\u0026rsquo;t Do It… Or Did It? A Comprehensive Guide to Defender for Endpoint Performance Analysis 02/06/2026 Experts Live NL Defending the Defender: Avoiding Misconfigurations in Defender XDR 02/06/2026 Experts Live NL Microsoft 365 Under Fire: Securing your tenant in 2026 06/11/2025 KustoCon 2025 Proactive Exposure hunting with Enterprise Exposure Graph 24/09/2025 Microsoft 365 Security \u0026amp; Compliance User Group Proactive Exposure hunting with Enterprise Exposure Graph 22/05/2025 MC2MC Live: The Matrix of Innovation Proactive Security: The shift from vulnerability management to Exposure management 27/02/2025 Workplace Ninja Usergroup Germany Proactive Security: The shift from vulnerability management to Exposure management 2026 AppManagEvent 2026 📅 9 October 2026 · 📍 The Netherlands · 🎤 Live event\nFrom Admin to Standard user with Intune EPM: notes from the field\n🔗 AppManagEvent.com\nDefender User Group 📅 24 September 2026\nFrom Uncertainty to Resolution, Faster: Troubleshooting Microsoft Defender for Endpoint\nWorkplace Ninja Summit 📅 17–18 September 2026 · 🎤 Live event\nTwo sessions this year:\nThe EDR Didn\u0026rsquo;t Do It… Or Did It? A Comprehensive Guide to Defender for Endpoint Performance Analysis (17 September, track: Security – Defender) From Admin to Standard user with Microsoft EPM: notes from the field (18 September, tracks: Windows \u0026amp; macOS – Management / Security) Experts Live NL 📅 2 June 2026 · 🎤 Live event\nTwo deep-dive (level 400) sessions:\nMicrosoft 365 Under Fire: Securing your tenant in 2026 Together with Louis Mastelinck · 10:10, Session Room 19 \u0026amp; 20\nMicrosoft 365 remains one of the most targeted enterprise platforms, with attackers continuously evolving their techniques to compromise identities, exfiltrate data, and establish persistence. This session cuts through the noise to focus on what actually matters for defending your tenant in 2026: from token theft and consent phishing to business email compromise and configuration drift, with practical hardening strategies including identity protection beyond basic MFA and Conditional Access policies that balance security with usability.\nDefending the Defender: Avoiding Misconfigurations in Defender XDR 11:10, Session Room 4 \u0026amp; 5\nMicrosoft Defender XDR is a powerful security platform, but even the best tools can only perform as well as they are configured. This session shines a light on the most common misconfigurations seen in real-world Defender XDR deployments and shows how to validate your configuration, close visibility gaps, strengthen detection capabilities, and make sure Defender XDR is working for you, not against you.\n2025 KustoCon 2025 📅 6 November 2025 · 🎤 Live\nProactive Exposure hunting with Enterprise Exposure Graph\n🔗 Sessions | KustoCon\nMicrosoft 365 Security \u0026amp; Compliance User Group 📅 24 September 2025 · 🌐 Online\nProactive Exposure hunting with Enterprise Exposure Graph\n🔗 Event details\nMC2MC Live: The Matrix of Innovation 📅 22 May 2025 · 🎤 Live\nProactive Security: The shift from vulnerability management to Exposure management (level 400, main session room)\n🔗 MC2MC Live: The Matrix of Innovation (22/05/2025)\nWorkplace Ninja Usergroup Germany 📅 27 February 2025 · 🌐 Online\nProactive Security: The shift from vulnerability management to Exposure management\n🎥 Watch the recording – #16 Meetup, Workplace Ninja Usergroup Germany\n","permalink":"https://vertho.tech/events/","summary":"\u003cp\u003eI regularly speak at conferences and user groups about Microsoft Security: Defender XDR, Exposure Management, Intune EPM and securing Microsoft 365.\u003c/p\u003e\n\u003cp\u003eWant me to speak at your event or user group? \u003ca href=\"/contact/\"\u003eGet in touch\u003c/a\u003e.\u003c/p\u003e\n\u003ch2 id=\"at-a-glance\"\u003eAt a glance\u003c/h2\u003e\n\u003ctable\u003e\n\t\u003cthead\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003cth\u003eDate\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eEvent\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eSession\u003c/th\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/thead\u003e\n\t\u003ctbody\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e09/10/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eAppManagEvent 2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eFrom Admin to Standard user with Intune EPM: notes from the field\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e24/09/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eDefender User Group\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eFrom Uncertainty to Resolution, Faster: Troubleshooting Microsoft Defender for Endpoint\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e18/09/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eWorkplace Ninja Summit\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eFrom Admin to Standard user with Microsoft EPM: notes from the field\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e17/09/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eWorkplace Ninja Summit\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eThe EDR Didn\u0026rsquo;t Do It… Or Did It? A Comprehensive Guide to Defender for Endpoint Performance Analysis\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e02/06/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eExperts Live NL\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eDefending the Defender: Avoiding Misconfigurations in Defender XDR\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e02/06/2026\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eExperts Live NL\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eMicrosoft 365 Under Fire: Securing your tenant in 2026\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e06/11/2025\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eKustoCon 2025\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eProactive Exposure hunting with Enterprise Exposure Graph\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e24/09/2025\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eMicrosoft 365 Security \u0026amp; Compliance User Group\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eProactive Exposure hunting with Enterprise Exposure Graph\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e22/05/2025\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eMC2MC Live: The Matrix of Innovation\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eProactive Security: The shift from vulnerability management to Exposure management\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003e27/02/2025\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eWorkplace Ninja Usergroup Germany\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eProactive Security: The shift from vulnerability management to Exposure management\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch2 id=\"2026\"\u003e2026\u003c/h2\u003e\n\u003ch3 id=\"appmanagevent-2026\"\u003eAppManagEvent 2026\u003c/h3\u003e\n\u003cp\u003e📅 9 October 2026 · 📍 The Netherlands · 🎤 Live event\u003c/p\u003e","title":"Events"},{"content":"Over the years I built a few tools to make my own work with Microsoft security products easier. They are free, open source and available on GitHub. All of them are PowerShell scripts with a graphical interface, so there are no commands to remember.\nMDE Troubleshooter Analyze and troubleshoot Microsoft Defender for Endpoint on a Windows device, all in one window.\nGives you a central view of the security configuration, logs and diagnostic actions on the local endpoint:\nDefender AV: versions, service status, real-time protection and scan information Attack Surface Reduction: status of every ASR rule, including per-rule exclusions Exclusions: all AV exclusions, and whether tamper protection covers them Updates: local engine, platform and signature versions compared with the latest from Microsoft Logs: SENSE, Defender AV, ASR and Controlled Folder Access events with filtering More: Performance Analyzer, proxy, firewall, connectivity checks and Troubleshooting Mode A Linux version (shell script) is included in the repository.\nRequirements: Windows 10/11 or Windows Server 2016+, PowerShell 5.1, administrator rights, Microsoft Defender Antivirus.\nRelated posts: MDE Troubleshooter is born · A new release after 2 years · v1.6.1 available\nView on GitHub MDI Configurator A graphical interface for configuring and validating Microsoft Defender for Identity.\nA wrapper around the official DefenderForIdentity PowerShell module that covers the full setup of an MDI deployment:\nConfiguration: apply the required audit policies and settings, in Domain or LocalMachine mode Test \u0026amp; validate: check whether each configuration is in place Reports: generate an HTML report of your MDI configuration Proxy: set, view, clear and test the sensor proxy settings Directory Service Account: create a DSA and test its permissions Requirements: Windows 10/11 or Windows Server 2016+, PowerShell 5.1, the DefenderForIdentity module, administrator rights.\nRelated post: MDI-configurator v1.0 is out!\nView on GitHub EpmTools GUI A point-and-click interface for Microsoft Intune Endpoint Privilege Management (EPM).\nA wrapper around the EPM Agent cmdlets, extended with Intune integration through Microsoft Graph:\nInspect the device: view the elevation rules, client settings and policies the EPM Agent received File attributes: extract publisher and certificate details from an .exe to build a rule Create rules: build an elevation rule and push it to an Intune policy Client settings: create, deploy and edit Intune elevation settings policies Reports: elevation events and reports by application, publisher or user, with filtering Export: save results as CSV or JSON Requirements: Windows 10/11 with the EPM Agent installed via Intune, Windows PowerShell 5.1 x64 (ARM64 supported).\nView on GitHub Found a bug or have an idea for a feature? Open an issue on GitHub or contact me.\n","permalink":"https://vertho.tech/tools/","summary":"\u003cp\u003eOver the years I built a few tools to make my own work with Microsoft security products easier. They are free, open source and available on GitHub. All of them are PowerShell scripts with a graphical interface, so there are no commands to remember.\u003c/p\u003e\n\u003csection class=\"tool-card\"\u003e\n  \u003ch2 id=\"mde-troubleshooter\"\u003eMDE Troubleshooter\u003c/h2\u003e\u003cp class=\"tool-tagline\"\u003eAnalyze and troubleshoot Microsoft Defender for Endpoint on a Windows device, all in one window.\u003c/p\u003e\n  \u003cdiv class=\"tool-body\"\u003e\n    \u003cp\u003eGives you a central view of the security configuration, logs and diagnostic actions on the local endpoint:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eDefender AV\u003c/strong\u003e: versions, service status, real-time protection and scan information\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAttack Surface Reduction\u003c/strong\u003e: status of every ASR rule, including per-rule exclusions\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExclusions\u003c/strong\u003e: all AV exclusions, and whether tamper protection covers them\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUpdates\u003c/strong\u003e: local engine, platform and signature versions compared with the latest from Microsoft\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLogs\u003c/strong\u003e: SENSE, Defender AV, ASR and Controlled Folder Access events with filtering\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMore\u003c/strong\u003e: Performance Analyzer, proxy, firewall, connectivity checks and Troubleshooting Mode\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eA Linux version (shell script) is included in the repository.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c/strong\u003e Windows 10/11 or Windows Server 2016+, PowerShell 5.1, administrator rights, Microsoft Defender Antivirus.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRelated posts:\u003c/strong\u003e \u003ca href=\"/2023/06/30/tool-mde-troubleshooter-is-born/\"\u003eMDE Troubleshooter is born\u003c/a\u003e · \u003ca href=\"/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/\"\u003eA new release after 2 years\u003c/a\u003e · \u003ca href=\"/2025/06/07/mde-troubleshooter-v1-6-1-available/\"\u003ev1.6.1 available\u003c/a\u003e\u003c/p\u003e\n\n  \u003c/div\u003e\n  \u003ca class=\"tool-btn\" href=\"https://github.com/v3rtho/MDE-troubleshooter\" rel=\"noopener\"\u003e\n    \u003csvg viewBox=\"0 0 24 24\" fill=\"currentColor\" aria-hidden=\"true\"\u003e\u003cpath d=\"M12 .5a11.5 11.5 0 0 0-3.64 22.41c.58.1.79-.25.79-.56v-2c-3.2.7-3.88-1.36-3.88-1.36-.52-1.33-1.28-1.69-1.28-1.69-1.05-.71.08-.7.08-.7 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.7 1.26 3.36.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.19-3.09-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.18 1.18a11 11 0 0 1 5.78 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.59.23 2.76.11 3.05.74.8 1.19 1.83 1.19 3.09 0 4.42-2.7 5.4-5.26 5.68.41.36.78 1.06.78 2.14v3.17c0 .31.21.67.8.56A11.5 11.5 0 0 0 12 .5Z\"/\u003e\u003c/svg\u003e\n    \u003cspan\u003eView on GitHub\u003c/span\u003e\n  \u003c/a\u003e\n\u003c/section\u003e","title":"Tools"}]