|
| 1 | +--- |
| 2 | +title: Guidance for pen testing and breach-and-attack-simulation (BAS) scenarios with Microsoft Defender for Endpoint |
| 3 | +description: This article provides guidance for conducting penetration testing and breach-and-attack simulation (BAS) scenarios using Microsoft Defender for Endpoint and Microsoft Defender Antivirus. |
| 4 | +ms.service: defender-endpoint |
| 5 | +ms.localizationpriority: medium |
| 6 | +ms.topic: conceptual |
| 7 | +author: emmwalshh |
| 8 | +ms.author: ewalsh |
| 9 | +ms.reviewer: yongrhee |
| 10 | +manager: deniseb |
| 11 | +ms.custom: nextgen |
| 12 | +ms.date: 02/19/2025 |
| 13 | +ms.subservice: ngp |
| 14 | +ms.collection: |
| 15 | +- m365-security |
| 16 | +- tier2 |
| 17 | +- mde-ngp |
| 18 | +search.appverid: met150 |
| 19 | +--- |
| 20 | + |
| 21 | +# Guidance for penetration testing and breach-and-attack-simulation scenarios with Microsoft Defender for Endpoint |
| 22 | + |
| 23 | +This article describes common challenges and potential misconfigurations that might arise during penetration testing (pen testing) or using breach and attack simulation (BAS) tools. This article also describes how to submit potential false negatives for investigation. |
| 24 | + |
| 25 | +## Common challenges during pen testing |
| 26 | + |
| 27 | +- Testing the current configuration of the environment, which might not be the optimal configuration for Microsoft Defender for Endpoint or Microsoft Defender Antivirus. |
| 28 | + |
| 29 | +- Concerns about enabling [cloud protection](cloud-protection-microsoft-defender-antivirus.md), as it might proceed to cloud protection detonation if it doesn't find metadata. For more information about Microsoft Defender Antivirus and cloud protection, see [hybrid detection and protection](/defender-endpoint/adv-tech-of-mdav). |
| 30 | + |
| 31 | +> [!NOTE] |
| 32 | +> If you're downloading multiple payloads and notice that Microsoft Defender Antivirus doesn't remediate some of the payloads, keep in mind that what's occurring might not be a true positive, and a non-Microsoft vendor might be showing a false positive. See [How to submit possible false negatives for investigation](#how-to-submit-possible-false-negatives-for-investigation) (in this article). |
| 33 | +
|
| 34 | +## Common misconfigurations of Microsoft Defender Antivirus during pen testing |
| 35 | + |
| 36 | +It's common for penetration testers to disable features of Microsoft Defender Antivirus while executing their attack. Before doing so, confirm that the following settings are configured: |
| 37 | + |
| 38 | +- [Tamper protection](/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) is enabled in block mode. |
| 39 | + |
| 40 | +- Microsoft Defender Antivirus is running as the primary antivirus, and not in [passive mode](/defender-endpoint/microsoft-defender-antivirus-compatibility). If you're using non-Microsoft antivirus, we recommend uninstalling it during pen testing. |
| 41 | + |
| 42 | +- [Platform update, engine update, and/or Security intelligence updates](/defender-endpoint/microsoft-defender-antivirus-updates) are up to date. |
| 43 | + |
| 44 | +- [Real-time protection](configure-protection-features-microsoft-defender-antivirus.md) is enabled. |
| 45 | + |
| 46 | +- [Behavior monitoring](/defender-endpoint/behavior-monitor) is enabled. |
| 47 | + |
| 48 | +- Adding [antivirus exclusions](configure-exclusions-microsoft-defender-antivirus.md) to where the payload is, after the payload is copied. After you copy the payload to the device, remove the antivirus exclusion so that Microsoft Defender Antivirus can block detections during pen testing. |
| 49 | + |
| 50 | +- Make sure that you don't have antivirus exclusions for your BAS tools, such as AttackIQ, Cymulate, SafeBreach, and others. |
| 51 | + |
| 52 | +- [Cloud-delivered protection](/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus) is enabled. |
| 53 | + |
| 54 | +- [Cloud protection sample submission](/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus) is enabled. |
| 55 | + |
| 56 | +- [Cloud protection network connection](/defender-endpoint/configure-network-connections-microsoft-defender-antivirus) is working. |
| 57 | + |
| 58 | +- [Protection from potentially unwanted apps](/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (PUA) is enabled. |
| 59 | + |
| 60 | +- [Attack surface reduction rules](/defender-endpoint/overview-attack-surface-reduction) (ASR rules) are set to block mode. |
| 61 | + |
| 62 | +- [Network Protection](/defender-endpoint/enable-network-protection) is set to block mode. |
| 63 | + |
| 64 | +- [Controlled Folder Access](/defender-endpoint/enable-controlled-folders) (CFA) is set to block mode. |
| 65 | + |
| 66 | +It's important to get the settings correct. To resolve misconfiguration issues, use the following articles: |
| 67 | + |
| 68 | +| OS | Management tool | Article | |
| 69 | +|--|--|--| |
| 70 | +| Windows | Microsoft Defender for Endpoint security settings management <br/>(*Recommended*) | [Evaluate Microsoft Defender Antivirus using Microsoft Defender Endpoint Security Settings Management (Endpoint security policies)](evaluate-mda-using-mde-security-settings-management.md) | |
| 71 | +| Windows | Group Policy | [Evaluate Microsoft Defender Antivirus using Group Policy](evaluate-mdav-using-gp.md) | |
| 72 | +| Windows | PowerShell | [Evaluate Microsoft Defender Antivirus using PowerShell](microsoft-defender-antivirus-using-powershell.md) | |
| 73 | +| Mac | Jamf (or another tool) | [Set preferences for Microsoft Defender for Endpoint on macOS](mac-preferences.md) | |
| 74 | +| Linux | Configuration profile <br/> Defender for Endpoint security settings management | [Set preferences for Microsoft Defender for Endpoint on Linux](linux-preferences.md) | |
| 75 | + |
| 76 | +## How to submit possible false negatives for investigation |
| 77 | + |
| 78 | +### Step 1: Gather the Microsoft Defender for Endpoint diagnostic logs |
| 79 | + |
| 80 | +#### Use the MDE Client Analyzer log |
| 81 | + |
| 82 | +| Operating system | What to do | |
| 83 | +|--|--| |
| 84 | +| Windows | You can collect diagnostics logs by using [Live Response](/defender-endpoint/run-analyzer-windows) or [locally](/defender-endpoint/run-analyzer-windows). | |
| 85 | +| Mac | You can collect [locally](/defender-endpoint/run-analyzer-macos). | |
| 86 | +| Linux | You can collect using [Live Response](/defender-endpoint/run-analyzer-linux) or [locally](/defender-endpoint/run-analyzer-linux). | |
| 87 | + |
| 88 | +#### Microsoft Defender Antivirus diagnostic data (MpSupport.cab) |
| 89 | + |
| 90 | +| Operating system | What to do | |
| 91 | +|--|--| |
| 92 | +| Windows | 1. On the device, open Command Prompt as an administrator. <br/>2. Run the following command: [MpCmdRun.exe -getfiles](/defender-endpoint/collect-diagnostic-data). <br/><br/>You can also [collect the investigation package](/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices) in the Microsoft Defender portal. | |
| 93 | +| Mac | 1. On the device, open Terminal (shell session). <br/>2. Run the following command: `mdatp log level set--level debug`. <br/>3. Run the following command: `sudo mdatp diagnostic create`. <br/><br/>For more information, see [Resources for Microsoft Defender for Endpoint on Mac](/defender-endpoint/mac-resources). | |
| 94 | +| Linux | 1. On the device, open Terminal (shell session). <br/>2. Run the following command: `mdatp log level set--level debug`. <br/>`sudo mdatp diagnostic create`. <br/><br/>For more information, see [Microsoft Defender for Endpoint on Linux resources](/defender-endpoint/linux-resources). | |
| 95 | + |
| 96 | +### Step 2: Gather information |
| 97 | + |
| 98 | +Ensure you have the following information ready |
| 99 | + |
| 100 | +- **Microsoft Defender OrgID**. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Microsoft Defender XDR** > **Account** > **Org ID**. |
| 101 | + |
| 102 | +- **Device ID**. In the [Microsoft Defender portal](https://security.microsoft.com), open the device page. |
| 103 | + |
| 104 | +- Binary names. |
| 105 | + |
| 106 | +- Start and end of when testing was done in `HH:MM:SS UTC` format. |
| 107 | + |
| 108 | +- It would be highly beneficial if you could provide the steps to reproduce the issue, along with a sample of the payload. |
| 109 | + |
| 110 | +### Step 3: Submit data to Microsoft as soon as possible |
| 111 | + |
| 112 | +It's crucial to report to Microsoft as soon as possible. The advanced hunting telemetry data wraps around and overwrites itself after 30 days. You can use either the Microsoft Defender Security Intelligence (MDSI) portal or the Microsoft Defender portal to submit your files. |
| 113 | + |
| 114 | +| Portal | Description | |
| 115 | +|--|--| |
| 116 | +| MDSI portal | The MDSI portal is a service provided by Microsoft Security Intelligence. It allows users to submit files for malware analysis. Microsoft security researchers analyze these files to determine if they're threats, unwanted applications, or normal files. The portal is used to report detection concerns to Microsoft Defender Research, submit files for analysis, and track the results of submissions.<br/><br/>This portal was formerly known as the Windows Defender Security Intelligence (WSDI). Because it currently supports Mac, Linux, and Android submissions, its name changed. | |
| 117 | +| Microsoft Defender portal | If you have a subscription to Microsoft Defender XDR, or your subscription includes Defender for Endpoint Plan 2, you can use the **Submissions** page in the Microsoft Defender portal. | |
| 118 | + |
| 119 | +1. Submit the data you gathered during steps 1-2 by using either the MDSI portal or the Microsoft Defender portal. |
| 120 | + |
| 121 | + - **MDSI portal**: Go to the [MDSI portal](https://www.microsoft.com/en-us/wdsi), and then select **Submit files**. Follow the guidance on the page. |
| 122 | + - **The Microsoft Defender portal**: See [Use admin submission for submitting files in Microsoft Defender for Endpoint](/defender-endpoint/admin-submissions-mde). |
| 123 | + |
| 124 | +2. After you upload the files, note the `Submission ID` for your sample submission (for example, `7c6c214b-17d4-4703-860b-7f1e9da03f7f`). |
| 125 | + |
| 126 | +3. Wait for an update. After Microsoft receives the sample, the file is investigated, and a determination is made. If Microsoft determines that the sample file is malicious, we take corrective action to prevent the malware from going undetected. |
| 127 | + |
| 128 | + If you have questions, [contact support](/defender-endpoint/contact-support). |
0 commit comments