Skip to content

Commit b61ead1

Browse files
joe-davies-affirmjoe-davies-affirm
authored
Merge branch 'MicrosoftDocs:main' into v-jodavies-eval-pilot-xdr-rework
2 parents b1a5ea4 + 88f2543 commit b61ead1

14 files changed

+367
-276
lines changed

‎defender-endpoint/behavior-monitor-macos.md‎

Lines changed: 114 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
---
22
title: Behavior Monitoring in Microsoft Defender Antivirus on macOS
33
description: Behavior Monitoring in Microsoft Defender Antivirus on macOS
4-
author: YongRhee-MSFT # GitHub alias
5-
ms.author: yongrhee # Microsoft alias
4+
author: YongRhee-MSFT
5+
ms.author: yongrhee
66
manager: deniseb
77
ms.service: defender-endpoint
88
ms.topic: overview
99
ms.date: 05/29/2024
1010
ms.subservice: ngp
1111
audience: ITPro
12-
ms.collection:
12+
ms.collection:
1313
- m365-security
1414
- tier2
1515
- mde-asr
16-
ms.custom:
16+
ms.custom:
1717
- partner-contribution
1818
ms.reviewer: yongrhee
1919
search.appverid: MET150
20-
f1.keywords: NOCSH
20+
f1.keywords: NOCSH
2121
---
2222

23-
# Behavior monitoring in Microsoft Defender Antivirus on macOS
23+
# Behavior monitoring in Microsoft Defender Antivirus on macOS
2424

2525
**Applies to:**
2626

@@ -39,19 +39,19 @@ f1.keywords: NOCSH
3939

4040
- Device is onboarded to Microsoft Defender for Endpoint.
4141
- [Preview features](/defender-endpoint/preview) is enabled in the Microsoft XDR portal ([https://security.microsoft.com](https://security.microsoft.com)).
42-
- Device must be in the [Beta channel](/defender-endpoint/mac-updates) (formerly InsiderFast). 
43-
- Minimal Microsoft Defender for Endpoint version number must be Beta (Insiders-Fast): 101.24042.0002 or newer. Version number refers to the **app_version** (also known as **Platform update**).
42+
- Device must be in the [Beta channel](/defender-endpoint/mac-updates) (formerly InsiderFast).
43+
- Minimal Microsoft Defender for Endpoint version number must be Beta (Insiders-Fast): 101.24042.0002 or newer. Version number refers to the **app_version** (also known as **Platform update**).
4444
- Ensure that Real-Time Protection (RTP) is enabled.
4545
- Ensure [cloud-delivered protection](/defender-endpoint/mac-preferences) is enabled.
4646
- Device must be explicitly enrolled into the preview.
4747

4848
## Overview
4949

50-
Behavior monitoring monitors process behavior to detect and analyze potential threats based on the behavior of the applications, daemons, and files within the system. As behavior monitoring observes how the software behaves in real-time, it can adapt quickly to new and evolving threats and block them.
50+
Behavior monitoring monitors process behavior to detect and analyze potential threats based on the behavior of the applications, daemons, and files within the system. As behavior monitoring observes how the software behaves in real-time, it can adapt quickly to new and evolving threats and block them.
5151

5252
## Deployment instructions
5353

54-
To deploy behavior monitoring in Microsoft Defender for Endpoint on macOS, you must change the behavior monitoring policy using one of the following methods:
54+
To deploy behavior monitoring in Microsoft Defender for Endpoint on macOS, you must change the behavior monitoring policy using one of the following methods:
5555

5656
- [Intune](#intune-deployment)
5757
- [JamF or other 3<sup>rd</sup> party MDM](#via-jamf-deployment)
@@ -63,78 +63,78 @@ The following sections describe each of these methods in detail.
6363

6464
1. Copy the following XML to create a _.plist_ file and save it as **BehaviorMonitoring_for_MDE_on_macOS.mobileconfig**
6565

66-
```xml
67-
<?xml version="1.0" encoding="UTF-8"?>
68-
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
69-
<plist version="1.0">
70-
<dict>
71-
<key>PayloadUUID</key>
72-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
73-
<key>PayloadType</key>
74-
<string>Configuration</string>
75-
<key>PayloadOrganization</key>
76-
<string>Microsoft</string>
77-
<key>PayloadIdentifier</key>
78-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
79-
<key>PayloadDisplayName</key>
80-
<string>Microsoft Defender for Endpoint settings</string>
81-
<key>PayloadDescription</key>
82-
<string>Microsoft Defender for Endpoint configuration settings</string>
83-
<key>PayloadVersion</key>
84-
<integer>1</integer>
85-
<key>PayloadEnabled</key>
86-
<true/>
87-
<key>PayloadRemovalDisallowed</key>
88-
<true/>
89-
<key>PayloadScope</key>
90-
<string>System</string>
91-
<key>PayloadContent</key>
92-
<array>
93-
<dict>
94-
<key>PayloadUUID</key>
95-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
96-
<key>PayloadType</key>
97-
<string>com.microsoft.wdav</string>
98-
<key>PayloadOrganization</key>
99-
<string>Microsoft</string>
100-
<key>PayloadIdentifier</key>
101-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
102-
<key>PayloadDisplayName</key>
103-
<string>Microsoft Defender for Endpoint configuration settings</string>
104-
<key>PayloadDescription</key>
105-
<string/>
106-
<key>PayloadVersion</key>
107-
<integer>1</integer>
108-
<key>PayloadEnabled</key>
109-
<true/>
110-
<key>antivirusEngine</key>
111-
<dict>
112-
<key>behaviorMonitoring</key>
113-
<string>enabled</string>
114-
</dict>
115-
<key>features</key>
116-
<dict>
117-
<key>behaviorMonitoring</key>
118-
<string>enabled</string>
119-
<key>behaviorMonitoringConfigurations</key>
120-
<dict>
121-
<key>blockExecution</key>
122-
<string>enabled</string>
123-
<key>notifyForks</key>
124-
<string>enabled</string>
125-
<key>forwardRtpToBm</key>
126-
<string>enabled</string>
127-
<key>avoidOpenCache</key>
128-
<string>enabled</string>
129-
</dict>
130-
</dict>
131-
</dict>
132-
</array>
133-
</dict>
134-
</plist>
135-
```
136-
137-
2. Open **Devices** > **Configuration profiles**.
66+
```xml
67+
<?xml version="1.0" encoding="UTF-8"?>
68+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
69+
<plist version="1.0">
70+
<dict>
71+
<key>PayloadUUID</key>
72+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
73+
<key>PayloadType</key>
74+
<string>Configuration</string>
75+
<key>PayloadOrganization</key>
76+
<string>Microsoft</string>
77+
<key>PayloadIdentifier</key>
78+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
79+
<key>PayloadDisplayName</key>
80+
<string>Microsoft Defender for Endpoint settings</string>
81+
<key>PayloadDescription</key>
82+
<string>Microsoft Defender for Endpoint configuration settings</string>
83+
<key>PayloadVersion</key>
84+
<integer>1</integer>
85+
<key>PayloadEnabled</key>
86+
<true/>
87+
<key>PayloadRemovalDisallowed</key>
88+
<true/>
89+
<key>PayloadScope</key>
90+
<string>System</string>
91+
<key>PayloadContent</key>
92+
<array>
93+
<dict>
94+
<key>PayloadUUID</key>
95+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
96+
<key>PayloadType</key>
97+
<string>com.microsoft.wdav</string>
98+
<key>PayloadOrganization</key>
99+
<string>Microsoft</string>
100+
<key>PayloadIdentifier</key>
101+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
102+
<key>PayloadDisplayName</key>
103+
<string>Microsoft Defender for Endpoint configuration settings</string>
104+
<key>PayloadDescription</key>
105+
<string/>
106+
<key>PayloadVersion</key>
107+
<integer>1</integer>
108+
<key>PayloadEnabled</key>
109+
<true/>
110+
<key>antivirusEngine</key>
111+
<dict>
112+
<key>behaviorMonitoring</key>
113+
<string>enabled</string>
114+
</dict>
115+
<key>features</key>
116+
<dict>
117+
<key>behaviorMonitoring</key>
118+
<string>enabled</string>
119+
<key>behaviorMonitoringConfigurations</key>
120+
<dict>
121+
<key>blockExecution</key>
122+
<string>enabled</string>
123+
<key>notifyForks</key>
124+
<string>enabled</string>
125+
<key>forwardRtpToBm</key>
126+
<string>enabled</string>
127+
<key>avoidOpenCache</key>
128+
<string>enabled</string>
129+
</dict>
130+
</dict>
131+
</dict>
132+
</array>
133+
</dict>
134+
</plist>
135+
```
136+
137+
2. Open **Devices** > **Configuration profiles**.
138138

139139
3. Select **Create profile** and select **New Policy**.
140140

@@ -152,35 +152,35 @@ The following sections describe each of these methods in detail.
152152

153153
1. Copy the following XML to create a _.plist_ file and save it as **Save as BehaviorMonitoring_for_MDE_on_macOS.plist**
154154

155-
```xml
156-
<?xml version="1.0" encoding="UTF-8"?>
157-
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
158-
<plist version="1.0">
159-
<dict>
160-
<key>antivirusEngine</key>
161-
<dict>
162-
<key>behaviorMonitoring</key>
163-
<string>enabled</string>
164-
</dict>
165-
<key>features</key>
166-
<dict>
167-
<key>behaviorMonitoring</key>
168-
<string>enabled</string>
169-
<key>behaviorMonitoringConfigurations</key>
170-
<dict>
171-
<key>blockExecution</key>
172-
<string>enabled</string>
173-
<key>notifyForks</key>
174-
<string>enabled</string>
175-
<key>forwardRtpToBm</key>
176-
<string>enabled</string>
177-
<key>avoidOpenCache</key>
178-
<string>enabled</string>
179-
</dict>
180-
</dict>
181-
</dict>
182-
</plist>
183-
```
155+
```xml
156+
<?xml version="1.0" encoding="UTF-8"?>
157+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
158+
<plist version="1.0">
159+
<dict>
160+
<key>antivirusEngine</key>
161+
<dict>
162+
<key>behaviorMonitoring</key>
163+
<string>enabled</string>
164+
</dict>
165+
<key>features</key>
166+
<dict>
167+
<key>behaviorMonitoring</key>
168+
<string>enabled</string>
169+
<key>behaviorMonitoringConfigurations</key>
170+
<dict>
171+
<key>blockExecution</key>
172+
<string>enabled</string>
173+
<key>notifyForks</key>
174+
<string>enabled</string>
175+
<key>forwardRtpToBm</key>
176+
<string>enabled</string>
177+
<key>avoidOpenCache</key>
178+
<string>enabled</string>
179+
</dict>
180+
</dict>
181+
</dict>
182+
</plist>
183+
```
184184

185185
2. In **Computers** > **Configuration Profiles**, select **Options** > **Applications & Custom Settings**,
186186
3. Select **Upload File** (_.plist_ file).
@@ -191,7 +191,7 @@ For more information, see: [Set preferences for Microsoft Defender for Endpoint
191191

192192
#### Manual deployment
193193

194-
You can enable Behavior Monitoring on Microsoft Defender for Endpoint on macOS by running the following command from the Terminal:
194+
You can enable Behavior Monitoring on Microsoft Defender for Endpoint on macOS by running the following command from the Terminal:
195195

196196
```bash
197197
sudo mdatp config behavior-monitoring --value enabled
@@ -216,7 +216,8 @@ The existing Microsoft Defender for Endpoint on macOS command line interface can
216216
```bash
217217
sudo mdatp threat list
218218
```
219-
### Frequently Asked Questions (FAQ):
219+
220+
### Frequently Asked Questions (FAQ)
220221

221222
#### What if I see an increase in cpu utilization or memory utilization?
222223

‎defender-endpoint/demonstration-behavior-monitoring.md‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ ms.date: 05/15/2024
2828
- [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md)
2929
- [Microsoft Defender for Individuals](https://www.microsoft.com/microsoft-365/microsoft-defender-for-individuals)
3030

31-
3231
Behavior Monitoring in Microsoft Defender Antivirus monitors process behavior to detect and analyze potential threats based on the behavior of applications, services, and files. Rather than relying solely on content matching, which identifies known malware patterns, behavior monitoring focuses on observing how software behaves in real-time.
3332

3433
## Scenario requirements and setup
@@ -57,20 +56,21 @@ To demonstrate how Behavior Monitoring blocks a payload:
5756

5857
1. Create a bash script using a script/text editor such as nano or Visual Studio Code (VS Code):
5958

60-
```bash
61-
#! /usr/bin/bash
62-
echo " " >> /tmp/9a74c69a-acdc-4c6d-84a2-0410df8ee480.txt 
63-
echo " " >>  /tmp/f918b422-751c-423e-bfe1-dbbb2ab4385a.txt 
64-
sleep 5
65-
```
59+
```bash
60+
#! /usr/bin/bash
61+
echo " " >> /tmp/9a74c69a-acdc-4c6d-84a2-0410df8ee480.txt
62+
echo " " >> /tmp/f918b422-751c-423e-bfe1-dbbb2ab4385a.txt
63+
sleep 5
64+
```
6665

6766
2. Save as BM_test.sh
68-
3. Run the following command to make the bash script executable.
67+
3. Run the following command to make the bash script executable:
6968

70-
```bash
71-
sudo chmod u+x BM_test.sh
72-
```
73-
4. . Run the bash script
69+
```bash
70+
sudo chmod u+x BM_test.sh
71+
```
72+
73+
4. Run the bash script:
7474

7575
```bash
7676
sudo bash BM_test.sh
@@ -99,4 +99,3 @@ Detection time: Tue May 7 20:23:41 2024
9999
Status: "quarantined"
100100

101101
If you have Microsoft Defender for Endpoint P2/P1 or Microsoft Defender for Business, go to the [Microsoft Defender XDR portal](https://security.microsoft.com), and you'll see an alert named: "Suspicious 'MacOSChangeFileTest' behavior was blocked."
102-

0 commit comments

Comments
 (0)