You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/adv-tech-of-mdav.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.reviewer: yongrhee
7
7
manager: deniseb
8
8
ms.service: defender-endpoint
9
9
ms.topic: overview
10
-
ms.date: 02/28/2024
10
+
ms.date: 01/24/2025
11
11
ms.subservice: ngp
12
12
ms.localizationpriority: medium
13
13
ms.custom: partner-contribution
@@ -53,6 +53,7 @@ When the client encounters unknown threats, it sends metadata or the file itself
53
53
|**Heuristics engine** <br/> Heuristic rules identify file characteristics that have similarities with known malicious characteristics to catch new threats or modified versions of known threats.|**Detonation-based ML engine** <br/> Suspicious files are detonated in a sandbox. Deep learning classifiers analyze the observed behaviors to block attacks.|
54
54
|**Emulation engine** <br/> The emulation engine dynamically unpacks malware and examines how they would behave at runtime. The dynamic emulation of the content and scanning both the behavior during emulation and the memory content at the end of emulation defeat malware packers and expose the behavior of polymorphic malware.|**Reputation ML engine** <br/> Domain-expert reputation sources and models from across Microsoft are queried to block threats that are linked to malicious or suspicious URLs, domains, emails, and files. Sources include Windows Defender SmartScreen for URL reputation models and Defender for Office 365 for email attachment expert knowledge, among other Microsoft services through the Microsoft Intelligent Security Graph.|
55
55
|**Network engine** <br/> Network activities are inspected to identify and stop malicious activities from threats.|**Smart rules engine** <br/> Expert-written smart rules identify threats based on researcher expertise and collective knowledge of threats.|
56
+
|**CommandLine scanning engine** <br/> This engine scans the commandlines of all processes before they execute. If the commandline for a process is found to be malicious it is blocked from execution.|**CommandLine ML engine** <br/> Multiple advanced ML models scan the suspicious commandlines in the cloud. If a commandline is found to be malicious, cloud sends a signal to the client to block the corresponding process from starting.|
56
57
57
58
For more information, see [Microsoft 365 Defender demonstrates 100 percent protection coverage in the 2023 MITRE Engenuity ATT&CK® Evaluations: Enterprise](https://www.microsoft.com/security/blog/2023/09/20/microsoft-365-defender-demonstrates-100-percent-protection-coverage-in-the-2023-mitre-engenuity-attck-evaluations-enterprise/).
58
59
@@ -97,6 +98,6 @@ We focus on every industry.
97
98
98
99
### Do your detection/protection require a human analyst?
99
100
100
-
When you're pen-testing, you should demand where no human analysts are engaged on detect/protect, to see how the actual antivirus engine (prebreach) efficacy truly is, and a separate one where human analysts are engaged.You can add [Microsoft Defender Experts for XDR](/defender-xdr/dex-xdr-overview) a managed extended detection and response service to augment your SOC.
101
+
When you're pen-testing, you should demand where no human analysts are engaged on detect/protect, to see how the actual antivirus engine (prebreach) efficacy truly is, and a separate one where human analysts are engaged.You can add [Microsoft Defender Experts for XDR](/defender-xdr/dex-xdr-overview) a managed extended detection and response service to augment your SOC.
101
102
102
103
The ***continuous iterative enhancement*** each of these engines to be increasingly effective at catching the latest strains of malware and attack methods. These enhancements show up in consistent [top scores in industry tests](/defender-xdr/top-scoring-industry-tests), but more importantly, translate to [threats and malware outbreaks](https://www.microsoft.com/security/blog/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/) stopped and [more customers protected](https://www.microsoft.com/security/blog/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise/).
Copy file name to clipboardExpand all lines: defender-endpoint/device-control-walkthroughs.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Learn how to work with device control in Defender for Endpoint.
4
4
author: denisebmsft
5
5
ms.author: deniseb
6
6
manager: deniseb
7
-
ms.date: 02/14/2024
7
+
ms.date: 01/24/2025
8
8
ms.topic: overview
9
9
ms.service: defender-endpoint
10
10
ms.subservice: asr
@@ -36,7 +36,7 @@ By default, [device control](device-control-overview.md) is disabled and there a
36
36
37
37
Device control in Defender for Endpoint identifies a device based on its properties. Device properties are visible by selecting an entry in the report.
38
38
39
-
The **Device ID**, **Vendor ID** (VID), **Serial number**, and **Bus type** can all be used to identify a device (see [Device control policies in Microsoft Defender for Endpoint](device-control-policies.mddata is also available in [advanced hunting](/defender-xdr/advanced-hunting-overview), by searching for the `Plug and Play Device Connected action` (`PnPDeviceConnected`), as shown in the following example query:
39
+
The **Device ID**, **Vendor ID** (VID), **Serial number**, and **Bus type** can all be used to identify a device (see [Device control policies in Microsoft Defender for Endpoint](device-control-policies.md)). Data is also available in [Advanced Hunting](/defender-xdr/advanced-hunting-overview), by searching for the Plug and Play Device Connected action (`PnPDeviceConnected`), as shown in the following example query:
40
40
41
41
```kusto
42
42
@@ -62,7 +62,7 @@ DeviceControlState : Disabled
62
62
63
63
```
64
64
65
-
Change the device control state to be enabled* on a test device. Make sure the policy is applied by checking [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus), as illustrated in the following snippet:
65
+
Change the device control state to be enabled on a test device. Make sure the policy is applied by checking [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus), as illustrated in the following snippet:
66
66
67
67
```powershell
68
68
@@ -184,7 +184,7 @@ The following screenshot shows the settings we used for our example:
184
184
185
185
By default, the sample uses the Global SID of `S-1-1-0`. Before deploying the policy, you can change the SID associated with the authorized USBs (writeable USBs) to `User1` and change the SID associated with the Read Only USBs to `User2`.
186
186
187
-
Once the policy is deployed, only User 1 has write access to the Authorized USBs, and only User 2 has read access to the ReadOnly USBs.
187
+
Once the policy is deployed, only User 1 has write access to the Authorized USBs, and only User 2 has read access to the ReadOnly USBs.
188
188
189
189
Device control also supports group SIDs. Change the SID in the read-only policy to a group that contains `User2`. Once the policy is redeployed, the rules are the same for User 2 or any other user in that group.
> In the examples above, we are setting it to 00 minutes, 6 a.m.(hour in 24 hour format), any day of the month, any month, on Sundays.[$(date +\%d)-le 15] == Won't run unless it's equal or less than the 15th day (3rd week). Meaning it will run every 3rd Sundays(7) of the month at 6:00 a.m. Pacific (UTC -8).
111
+
> In the previous examples, we specified `00` minutes, 6 a.m. (hour using the 24-hour format), any day of the month, any month, on Sundays.
112
+
>`[$(date +\%d)-le 15]` doesn't run unless it's equal or less than the 15th day (third week).
113
+
> This means the job runs at 6 a.m. every Sunday, but only if the day of the month is the 15th or earlier.
> - Virtual files, or files that are not fully present locally
115
+
> - Virtual files, or files that aren't fully present locally
116
116
>
117
117
> These file types *are* supported by [PowerShell](/powershell/scripting/overview).
118
118
>
@@ -199,6 +199,9 @@ remediate process 7960
199
199
remediate list
200
200
```
201
201
202
+
> [!NOTE]
203
+
> Currently, `HKEY_USERS` reg hive isn't supported for `remediate`. This is a known issue, and we're looking into it.
204
+
202
205
## `run`
203
206
204
207
```console
@@ -214,9 +217,9 @@ run get-process-by-name.ps1 -parameters "-processName Registry"
214
217
> [!NOTE]
215
218
>
216
219
> For long running commands such as '**run**' or '**getfile**', you may want to use the '**&**' symbol at the end of the command to perform that action in the background.
217
-
> This will allow you to continue investigating the machine and return to the background command when done using '**fg**' [basic command](live-response.md#basic-commands).
220
+
> This allows you to continue investigating the machine and return to the background command when done using '**fg**' [basic command](live-response.md#basic-commands).
218
221
>
219
-
> When passing parameters to a live response script, do not include the following forbidden characters: **';'**, **'&'**, **'|'**, **'!'**, and **'$'**.
222
+
> When passing parameters to a live response script, don't include the following forbidden characters: **';'**, **'&'**, **'|'**, **'!'**, and **'$'**.
Copy file name to clipboardExpand all lines: defender-endpoint/live-response.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,7 +64,7 @@ Before you can initiate a session on a device, make sure you fulfill the followi
64
64
65
65
-**Windows Server 2016** - with [KB5005292](https://support.microsoft.com/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac)
66
66
> [!NOTE]
67
-
> For Windows Server 2012R2 or 2016 you must have the [Unified Agent](update-agent-mma-windows.md#update-mma-on-your-devices) installed, and it is recommended to patch to latest sensor version with KB5005292.
67
+
> For Windows Server 2012 R2 or Windows Server 2016, you must have the [Unified Agent](update-agent-mma-windows.md#update-mma-on-your-devices) installed, and it is recommended to patch to latest sensor version with KB5005292. Live response doesn't work as expected for offline down-level servers onboarded using the streamlined method, because of the static proxy. Consider using a system proxy instead.
68
68
69
69
-**Windows Server 2019**
70
70
- Version 1903 or (with [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384)) later
Copy file name to clipboardExpand all lines: defender-endpoint/mac-whatsnew.md
+24-9Lines changed: 24 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: deniseb
6
6
ms.author: deniseb
7
7
manager: deniseb
8
8
ms.localizationpriority: medium
9
-
ms.date: 12/11/2024
9
+
ms.date: 01/24/2025
10
10
audience: ITPro
11
11
ms.collection:
12
12
- m365-security
@@ -46,7 +46,7 @@ For more information on Microsoft Defender for Endpoint on other operating syste
46
46
- On macOS Sequoia (Version 15.0 - 15.1.1), users may encounter prompts about incoming network connections from applications when the native firewall is active.
47
47
48
48
49
-
49
+
50
50
If an end user encounters a prompt for Defender for Endpoint on macOS processes such as `wdavdaemon_enterprise` or `Microsoft Defender Helper`, the end user can safely choose the **Deny** option. This selection doesn't impact Defender for Endpoint's functionality. Enterprises can also add *Microsoft Defender* to allow [incoming connections](https://support.apple.com/en-ca/guide/deployment/dep8d306275f/web). This issue is fixed in macOS Sequoia 15.2.
51
51
52
52
## Sequoia support
@@ -64,6 +64,21 @@ If an end user encounters a prompt for Defender for Endpoint on macOS processes
64
64
65
65
Behavior monitoring monitors process behavior to detect and analyze potential threats based on the behavior of the applications, daemons, and files within the system. As behavior monitoring observes how the software behaves in real-time, it can adapt quickly to new and evolving threats and block them. To learn more, see [Behavior Monitoring in Microsoft Defender for Endpoint on macOS](behavior-monitor-macos.md).
-**Improved User/Group Permission Handling** - Added reporting in `mdatp-health` for user/group permission issues for Defender files. On restart Defender attempts to cure these issues.
Copy file name to clipboardExpand all lines: defender-office-365/submissions-users-report-message-add-in-configure.md
+4-9Lines changed: 4 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ manager: deniseb
8
8
audience: Admin
9
9
ms.reviewer: dhagarwal
10
10
ms.topic: how-to
11
-
ms.date: 09/27/2024
11
+
ms.date: 01/24/2025
12
12
ms.localizationpriority: medium
13
13
search.appverid:
14
14
- MET150
@@ -66,15 +66,10 @@ After the add-in is installed and enabled, users see the following icons based o
66
66
67
67
-**Outlook on the web**:
68
68
69
-
- <u>The Report Message add-in</u>:
69
+
- <u>The Report Message or Report Phishing icons in Outlook on the web (formerly known as Outlook Web App or OWA)</u>:
70
70
71
71
> [!div class="mx-imgBorder"]
72
-
> :::image type="content" source="media/owa-report-message-icon.png" alt-text="The Report Message add-in icon in Outlook on the web." lightbox="media/owa-report-message-icon.png":::
73
-
74
-
- <u>The Report Phishing add-in</u>:
75
-
76
-
> [!div class="mx-imgBorder"]
77
-
> :::image type="content" source="media/OWA-ReportPhishing.png" alt-text="The Report Phishing add-in icon in Outlook on the web." lightbox="media/OWA-ReportPhishing.png":::
72
+
> :::image type="content" source="media/owa-report-message-icon.png" alt-text="The Report Message or Report Phishing add-in icons in Outlook on the web." lightbox="media/owa-report-message-icon.png":::
78
73
79
74
## What do you need to know before you begin?
80
75
@@ -185,7 +180,7 @@ Install and configure the Report Message or Report Phishing add-ins for the orga
185
180
186
181
### Get the Report Message or the Report Phishing add-ins for your Microsoft 365 GCC or GCC High organization
187
182
188
-
Admins in Microsoft 365 Government Community Cloud (GCC) or GCC High need to use the steps in this section to get the Report Message or Report Phishing add-ins for their organizations. These steps apply to Outlook and Outlook on the web (formerly known as Outlook Web App or OWA) and don't apply to Outlook for iOS and Android.
183
+
Admins in Microsoft 365 Government Community Cloud (GCC) or GCC High need to use the steps in this section to get the Report Message or Report Phishing add-ins for their organizations. These steps apply to Outlook and Outlook on the web and don't apply to Outlook for iOS and Android.
189
184
190
185
> [!NOTE]
191
186
> It could take up to 24 hours for the add-in to appear in your organization.
| 68411 | Fixed inaccurate detections in WebM Project libwebp by excluding razer file path | 22-Jan-25 |
57
+
| 77999 | Defender Vulnerability Management doesn't currently support these four ESET vulnerabilities: <br/>- CVE-2020-11446<br/>- CVE-2023-5594<br/>- CVE-2023-3160<br/>- CVE-2024-7400 | 22-Jan-25 |
58
+
48
59
49
60
## November 2024
50
61
@@ -54,6 +65,7 @@ The following tables present the relevant vulnerability information organized by
54
65
| 78428 | Added Microsoft Defender Vulnerability Management support to TeamViewer vulnerabilities- CVE-2024-7479 and CVE-2024-7481 | 12-Nov-24 |
0 commit comments