Skip to content

Commit 8a2e28b

Browse files
kerodrikerodri
committed
Auto-update: nav, content, or metadata
1 parent 3d47cd1 commit 8a2e28b

File tree

3 files changed

+171
-0
lines changed

3 files changed

+171
-0
lines changed

‎docs/Defender for Endpoint/Endpoint Detection and Response/ECS/How to Manually Test MDE’s ECS Networking.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
2+
# How to Manually Test Microsoft Defender’s ECS Networking Component
3+
4+
## Summary
5+
6+
Microsoft Defender for Endpoint (MDE) includes an ECS (Endpoint Cloud Service) component responsible for coordinating cloud-based threat intelligence and updates. While most ECS functionality is validated by the Client Analyzer tool, the **networking portion is not tested** by it. This article explains the behavior and provides a script to manually verify ECS connectivity and DNS resolution.
7+
8+
---
9+
10+
## Details
11+
12+
**Environment:**
13+
- Microsoft Defender for Endpoint
14+
- Windows 10/11, Server 2016-2022
15+
- ECS functionality enabled
16+
17+
**Issue:**
18+
ECS connectivity issues may arise, but the **Client Analyzer** tool does **not** currently test the **network layer** or the ability to reach ECS endpoints over HTTPS.
19+
20+
**Clarification:**
21+
The ECS module uses specific telemetry URLs and network routes that may not follow the standard update or telemetry paths. Manual validation is often required, especially in environments with custom proxies, DPI/SSL inspection, or strict outbound firewall rules.
22+
23+
---
24+
25+
## Solution: Manual ECS Network Test Script
26+
27+
The following PowerShell script performs:
28+
29+
- Network trace capture
30+
- ECS URL detection
31+
- DNS resolution
32+
- Port 443 connectivity test
33+
- Proxy configuration readout
34+
- ECS endpoint web request
35+
36+
> **Note:** Run this in an **elevated PowerShell session**. The script will create a `.txt` report and `.etl` network trace file on the user's Desktop.
37+
38+
<details>
39+
<summary><strong>Click to expand the full PowerShell script</strong></summary>
40+
41+
```powershell
42+
# --- Setup Paths and Timestamps ---
43+
$desktopPath = [Environment]::GetFolderPath("Desktop")
44+
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
45+
$reportName = "Defender_ECS_Report_$timestamp.txt"
46+
$reportPath = Join-Path $desktopPath $reportName
47+
$traceName = "Defender_ECS_Capture_$timestamp.etl"
48+
$traceTempPath = Join-Path $env:TEMP $traceName
49+
$traceFinalPath = Join-Path $desktopPath $traceName
50+
51+
# Clear/Create report file
52+
"" | Out-File -FilePath $reportPath -Encoding UTF8
53+
54+
# --- Start Network Capture ---
55+
"Starting network capture..." | Tee-Object -FilePath $reportPath -Append
56+
netsh trace start capture=yes tracefile="$traceTempPath" persistent=no maxsize=100 overwrite=yes | Out-String | Tee-Object -FilePath $reportPath -Append
57+
58+
# --- Locate MpCmdRun.exe in Latest Defender Platform ---
59+
$basePath = "C:\ProgramData\Microsoft\Windows Defender\Platform"
60+
$latestDir = Get-ChildItem -Path $basePath -Directory |
61+
Where-Object { $_.Name -match '^\d+\.\d+\.\d+\.\d+-\d+$' } |
62+
Sort-Object Name -Descending |
63+
Select-Object -First 1
64+
65+
$mpCmdRunPath = Join-Path -Path $latestDir.FullName -ChildPath "MpCmdRun.exe"
66+
"Latest Defender Platform: $($latestDir.Name)" | Tee-Object -FilePath $reportPath -Append
67+
68+
# --- Get ECS Base URL ---
69+
$ecsOutput = & $mpCmdRunPath -DisplayECSConnection
70+
$ecsBaseUrl = ($ecsOutput | Where-Object { $_ -match '^ECS Url:' }) -replace '^ECS Url:\s*', ''
71+
72+
# --- Build Full URL ---
73+
$queryString = '?CampPlatformVersion=6&EngineMinorVersion=1&EngineRing=2&EngineVersion=25060&IsBeta=0&IsEmbedded=0&IsEnterprise=1&IsMsSense=1&IsMsft=0&IsServer=1&IsSeville=1&MoCampBuildRev=1641676800&MoCampVersion=262162&OsBuildMinNumber=2134&OsBuildNumber=22621&OsMajorMinorVersion=655360&PlatformRing=2&SignatureRing=5&Engine_Ring=2'
74+
$finalUrl = "$ecsBaseUrl" + 'MicrosoftWindowsDefenderClient/1.0.0.0' + $queryString
75+
"Final ECS URL: $finalUrl" | Tee-Object -FilePath $reportPath -Append
76+
77+
# --- DNS and Connectivity Tests ---
78+
try {
79+
$ecsUri = [System.Uri]$finalUrl
80+
$hostName = $ecsUri.Host
81+
82+
"DNS Lookup for ${hostName}:" | Tee-Object -FilePath $reportPath -Append
83+
Resolve-DnsName $hostName -ErrorAction SilentlyContinue | Out-String | Tee-Object -FilePath $reportPath -Append
84+
85+
"Port 443 Connectivity Test:" | Tee-Object -FilePath $reportPath -Append
86+
Test-NetConnection -ComputerName $hostName -Port 443 | Out-String | Tee-Object -FilePath $reportPath -Append
87+
} catch {
88+
"Could not resolve or test connectivity to $hostName" | Tee-Object -FilePath $reportPath -Append
89+
}
90+
91+
# --- Show System Proxy Settings ---
92+
"System Proxy Configuration:" | Tee-Object -FilePath $reportPath -Append
93+
(netsh winhttp show proxy) | Out-String | Tee-Object -FilePath $reportPath -Append
94+
95+
# --- ECS Web Request ---
96+
try {
97+
$response = Invoke-WebRequest -Uri $finalUrl -UseBasicParsing -ErrorAction Stop
98+
99+
"Web Request Successful:" | Tee-Object -FilePath $reportPath -Append
100+
"Status Code: $($response.StatusCode)" | Tee-Object -FilePath $reportPath -Append
101+
"Response Headers:" | Tee-Object -FilePath $reportPath -Append
102+
$response.Headers | Out-String | Tee-Object -FilePath $reportPath -Append
103+
} catch {
104+
"Web Request Failed:" | Tee-Object -FilePath $reportPath -Append
105+
"Error Message: $($_.Exception.Message)" | Tee-Object -FilePath $reportPath -Append
106+
107+
if ($_.Exception.InnerException) {
108+
"Inner Exception: $($_.Exception.InnerException.Message)" | Tee-Object -FilePath $reportPath -Append
109+
}
110+
111+
if ($_.Exception -is [System.Net.WebException]) {
112+
$webEx = $_.Exception
113+
if ($webEx.Response) {
114+
$reader = New-Object System.IO.StreamReader($webEx.Response.GetResponseStream())
115+
$body = $reader.ReadToEnd()
116+
"Server Response:" | Tee-Object -FilePath $reportPath -Append
117+
$body | Tee-Object -FilePath $reportPath -Append
118+
}
119+
}
120+
}
121+
122+
# --- Stop Network Capture ---
123+
"Stopping network capture..." | Tee-Object -FilePath $reportPath -Append
124+
netsh trace stop | Out-String | Tee-Object -FilePath $reportPath -Append
125+
Start-Sleep -Seconds 2
126+
127+
# --- Move ETL File to Desktop ---
128+
if (Test-Path $traceTempPath) {
129+
Move-Item -Path $traceTempPath -Destination $traceFinalPath -Force
130+
"ETL file saved to: $traceFinalPath" | Tee-Object -FilePath $reportPath -Append
131+
} else {
132+
"Trace file not found in temp location." | Tee-Object -FilePath $reportPath -Append
133+
}
134+
135+
# --- Final Report Location ---
136+
"Diagnostic report saved to: $reportPath" | Tee-Object -FilePath $reportPath -Append
137+
138+
# --- Open ECS URL in Default Browser ---
139+
Start-Process $finalUrl
140+
```
141+
</details>
142+
143+
---
144+
145+
## Output
146+
147+
- **ETL File:** Captures ECS network traffic
148+
- **Report File:** Includes:
149+
- Platform version used
150+
- ECS base and full URLs
151+
- DNS resolution results
152+
- Port 443 connectivity
153+
- Proxy config
154+
- ECS web request result
155+
156+
---
157+
158+
## Additional Notes
159+
160+
- If the `Invoke-WebRequest` fails, investigate proxy settings, DNS filtering, or outbound HTTPS rules.
161+
- ECS uses `MicrosoftWindowsDefenderClient` URLs that are **not used for AV updates**.
162+
163+
---
164+
165+
## Applies To
166+
167+
- Microsoft Defender for Endpoint
168+
- Microsoft Defender AV Platform versions 4.18.x and newer

‎docs/Defender for Endpoint/Endpoint Detection and Response/matematica.pdf‎

825 KB
Binary file not shown.

‎mkdocs.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ nav:
2323
: Defender for Endpoint/Endpoint Detection and Response/Device Control/How-to-Configure-Device-Control-on-macOS,-Use-case-1.-Deny-write-access-to-all-USB-storage-except-for-specific-VendorID-and-ProductID-combinations-(Jamf).md
2424
- Using The Device Control Policy Sample Builder: Defender for Endpoint/Endpoint
2525
Detection and Response/Device Control/Using-the-device-control-policy-sample-builder.md
26+
- ECS:
27+
- How To Manually Test Mde’S Ecs Networking: Defender for Endpoint/Endpoint
28+
Detection and Response/ECS/How to Manually Test MDE’s ECS Networking.md
2629
- Mde Connectivity Channels: Defender for Endpoint/Endpoint Detection and Response/mde_connectivity_channels.md
2730
- Microsoft Defender Core Service:
2831
- Ecs Connectivity Diagnostic: Defender for Endpoint/Endpoint Detection and

0 commit comments

Comments
 (0)