Merge branch 'v-jodavies-eval-pilot-xdr-rework' of https://github.com/joe-davies-affirm/defender-docs-pr into v-jodavies-eval-pilot-xdr-rework

joe-davies-affirm · joe-davies-affirm · commit 3ad57f5d725e · 2024-05-31T10:48:42.000-07:00
merge
diff --git a/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md b/defender-endpoint/configure-advanced-scan-types-microsoft-defender-antivirus.md
@@ -9,7 +9,7 @@ ms.custom: nextgen
 ms.reviewer: pahuijbr
 manager: deniseb
 ms.subservice: ngp
-ms.date: 02/16/2024
+ms.date: 05/30/2024
 ms.collection: 
 - m365-security
 - tier2
@@ -23,7 +23,7 @@ search.appverid: met150
 **Applies to:**
 - [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
 - [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
-- Microsoft Defender Antivirus
+- [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md)
 
 **Platforms**
 - Windows 
diff --git a/defender-endpoint/mac-whatsnew.md b/defender-endpoint/mac-whatsnew.md
@@ -6,7 +6,7 @@ author: YongRhee-MSFT
 ms.author: yongrhee
 manager: dansimp
 ms.localizationpriority: medium
-ms.date: 05/07/2024
+ms.date: 05/30/2024
 audience: ITPro
 ms.collection:
 - m365-security
@@ -53,6 +53,18 @@ Microsoft Defender for Endpoint no longer supports Big Sur (11)
 
 Behavior monitoring monitors process behavior to detect and analyze potential threats based on the behavior of the applications, daemons, and files within the system. As behavior monitoring observes how the software behaves in real-time, it can adapt quickly to new and evolving threats and block them. To learn more, see [Behavior Monitoring in Microsoft Defender for Endpoint on macOS](behavior-monitor-macos.md).
 
+### May-2024 (Build: 101.24042.0008  | Release version: 20.124042.8.0)
+
+| Build:             | **101.24042.0008**    |
+|--------------------|-----------------------|
+| Release version:   | **20.124042.8.0**    |
+| Engine version:    | **1.1.24050.7**       |
+| Signature version: | **1.413.13.0**       |
+
+#### What's new
+
+- Bug and performance fixes
+
 ### Apr-2024 (Build: 101.24032.0006  | Release version: 20.124032.06.0)
 
 | Build:             | **101.24032.0006**    |
@@ -998,9 +1010,4 @@ Network protection for macOS is now available for all Mac devices onboarded to D
 
 - Performance improvements & bug fixes
 
-
-
-
-
-
-[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
+[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
diff --git a/defender-endpoint/malware/exploits-malware.md b/defender-endpoint/malware/exploits-malware.md
@@ -2,9 +2,7 @@
 title: Exploits and exploit kits
 ms.reviewer: 
 description: Learn about how exploits use vulnerabilities in common software to give attackers access to your computer and install other malware.
-keywords: security, malware, exploits, exploit kits, prevention, vulnerabilities, Microsoft, Exploit malware family, exploits, java, flash, adobe, update software, prevent exploits, exploit pack, vulnerability, 0-day, holes, weaknesses, attack, Flash, Adobe, out-of-date software, out of date software, update, update software, reinfection, Java cache, reinfected,  won't remove, won't clean, still detects, full scan, MSE, Defender, WDSI, MMPC, Microsoft Malware Protection Center
 ms.service: defender-endpoint
-ms.mktglfcycl: secure
 ms.localizationpriority: medium
 ms.author: dansimp
 author: dansimp
@@ -15,7 +13,7 @@ ms.collection:
 - tier2
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 03/18/2022
+ms.date: 05/30/2024
 ---
 
 # Exploits and exploit kits
@@ -36,7 +34,7 @@ The infographic below shows how an exploit kit might attempt to exploit a device
 
 *Figure 1. Example of how to exploit kits work*
 
-Several notable threats, including Wannacry, exploit the Server Message Block (SMB) vulnerability CVE-2017-0144 to launch malware.
+Notable threats use exploit kits to spread ransomware, including JSSLoader. The threat actor tracked by Microsoft as Storm-0324 (DEV-0324) uses this malware to facilitate access for the ransomware-as-a-service (RaaS) actor [Sangria Tempest](https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/#ELBRUS] (ELBRUS, Carbon Spider, FIN7).
 
 Examples of exploit kits:
 
@@ -61,4 +59,4 @@ You can read more on the [CVE website](https://cve.mitre.org/).
 
 The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities, so make sure these updates are applied to all devices.
 
-For more general tips, see [prevent malware infection](prevent-malware-infection.md).
+For more general tips, see [prevent malware infection](prevent-malware-infection.md).
diff --git a/defender-endpoint/microsoft-defender-endpoint-linux.md b/defender-endpoint/microsoft-defender-endpoint-linux.md
@@ -15,7 +15,7 @@ ms.collection:
 ms.topic: conceptual
 ms.subservice: linux
 search.appverid: met150
-ms.date: 05/08/2024
+ms.date: 05/30/2024
 ---
 
 # Microsoft Defender for Endpoint on Linux
@@ -105,7 +105,9 @@ In general you need to take the following steps:
     > [!NOTE]
     > Distributions and version that are not explicitly listed are unsupported (even if they are derived from the officially supported distributions).
     > With RHEL 6 support for 'extended end of life' coming to an end by June 30, 2024; MDE Linux support for RHEL 6 will also be deprecated by June 30, 2024
-    > MDE Linux version 101.23082.0011 is the last MDE Linux release supporting RHEL 6.7 or higher versions (does not expire before June 30, 2024). Customers are advised to plan upgrades to their RHEL 6 infrastructure aligned with guidance from Red Hat. 
+    > MDE Linux version 101.23082.0011 is the last MDE Linux release supporting RHEL 6.7 or higher versions (does not expire before June 30, 2024). Customers are advised to plan upgrades to their RHEL 6 infrastructure aligned with guidance from Red Hat.
+    >
+    > Microsoft Defender Vulnerablity Management is not supported on Alma currently.
 
 - List of supported kernel versions
 
@@ -255,4 +257,3 @@ High I/O workloads from certain applications can experience performance issues w
 - [Turn on network protection for Linux](network-protection-linux.md)
 
 [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
-
diff --git a/defender-endpoint/windows-whatsnew.md b/defender-endpoint/windows-whatsnew.md
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-ms.date: 11/06/2023
+ms.date: 05/30/2024
 manager: deniseb
 audience: ITPro
 ms.collection: 
@@ -45,7 +45,7 @@ All updates contain:
 - Serviceability improvements
 - Integration improvements (Cloud, [Microsoft Defender XDR](/defender-xdr))
 
-## April-2024 (Release version: 10.8750)
+## May-2024 (Release version: 10.8750)
 
 |OS  |KB  |Release version |
 | -------- | -------- | -------- |
diff --git a/defender-office-365/quarantine-policies.md b/defender-office-365/quarantine-policies.md
@@ -801,7 +801,7 @@ If the **Block sender** permission is disabled, users can't block senders from q
 For more information about the Blocked Senders list, see [Block messages from someone](https://support.microsoft.com/office/274ae301-5db2-4aad-be21-25413cede077#__toc304379667) and [Use Exchange Online PowerShell to configure the safelist collection on a mailbox](configure-junk-email-settings-on-exo-mailboxes.md#use-exchange-online-powershell-to-configure-the-safelist-collection-on-a-mailbox).
 
 > [!TIP]
-> The organization can still receive mail from the blocked sender. Messages from the sender are delivered to user Junk Email folders or to quarantine. To delete messages from the sender upon arrival, use [mail flow rules](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules) (also known as transport rules) to **Block the message**.
+> The organization can still receive mail from the blocked sender. Messages from the sender are delivered to user Junk Email folders or to quarantine depending on the policy precedence as described in [User allows and blocks](how-policies-and-protections-are-combined.md#user-allows-and-blocks). To delete messages from the sender upon arrival, use [mail flow rules](/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules) (also known as transport rules) to **Block the message**.
 
 ##### Delete permission
 
diff --git a/defender-office-365/try-microsoft-defender-for-office-365.md b/defender-office-365/try-microsoft-defender-for-office-365.md
@@ -439,6 +439,10 @@ A: No. The trial automatically provisions Defender for Office 365 Plan 2 license
 
 A: See [Extend your trial](/microsoft-365/commerce/try-or-buy-microsoft-365#extend-your-trial).
 
+### Q: Why do I not see options to cancel or extend the trial?
+
+A: You don't see options to cancel or extend your trial if your subscription is part of the New Commerce Experience (NCE). Currently, only customers on legacy subscriptions have the capability to cancel or extend their trials. 
+
 ### Q: What happens to my data after the trial expires?
 
 A: After your trial expires, you have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial are deleted.
