You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .acrolinx-config.edn
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
{:changed-files-limit60
2
2
:allowed-branchname-matches ["main""release-.*"]
3
-
:allowed-filename-matches ["ATADocs/""CloudAppSecurityDocs/""exposure-management/""defender/""defender-business/""defender-endpoint/""defender-for-cloud/""defender-for-iot/""defender-office-365/""defender-vulnerability-management/""defender-xdr/"] ;; Can be overridden in repo-specific edn file. This is an allow list that identifies which folders contain the files Acrolinx will check. Separate multiple folders as follows ["folder/" "folder2"]
3
+
:allowed-filename-matches ["ATADocs/""CloudAppSecurityDocs/""defender/""defender-business/""defender-endpoint/""defender-for-cloud/""defender-for-iot/""defender-office-365/""defender-vulnerability-management/""defender-xdr/""exposure-management/""unified-secops-platform/"] ;; Can be overridden in repo-specific edn file. This is an allow list that identifies which folders contain the files Acrolinx will check. Separate multiple folders as follows ["folder/" "folder2"]
Copy file name to clipboardExpand all lines: defender-endpoint/evaluate-exploit-protection.md
+60-8Lines changed: 60 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- tier2
16
16
- mde-asr
17
17
search.appverid: met150
18
-
ms.date: 12/18/2020
18
+
ms.date: 11/15/2024
19
19
---
20
20
21
21
# Evaluate exploit protection
@@ -31,7 +31,56 @@ ms.date: 12/18/2020
31
31
32
32
[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.)
33
33
34
-
In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* have happened if you enabled exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
34
+
In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* happen if you enable exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
35
+
36
+
## Generic guidelines
37
+
38
+
Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection.
39
+
40
+
#### What kinds of Software shouldn't be protected by exploit protection?
41
+
42
+
- Anti-malware and intrusion prevention or detection software
43
+
- Debuggers
44
+
- Software that handles digital rights management (DRM) technologies (that is, video games)
45
+
- Software that use anti-debugging, obfuscation, or hooking technologies
46
+
47
+
#### What type of applications should you consider enabling exploit protection?
48
+
49
+
Applications that receive or handle untrusted data.
50
+
51
+
#### What type of processes are out of scope for exploit protection?
52
+
53
+
Services
54
+
55
+
- System services
56
+
- Network services
57
+
58
+
## Application compatibility list
59
+
60
+
The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues can introduced when you apply certain add-ins or other components to the standard software.
| Certain AMD (ATI) video drivers | System ASLR=AlwaysOn |
69
+
| DropBox | EAF |
70
+
| Excel Power Query, Power View, Power Map and PowerPivot | EAF |
71
+
| Google Chrome | EAF+ |
72
+
| Immidio Flex+ | Cell 4 |
73
+
| Microsoft Office Web Components (OWC) | System DEP=AlwaysOn |
74
+
| Microsoft PowerPoint | EAF |
75
+
| Microsoft Teams | EAF+ |
76
+
| Oracle Javaǂ | Heapspray |
77
+
| Pitney Bowes Print Audit 6 | SimExecFlow |
78
+
| Siebel CRM version is 8.1.1.9 | SEHOP |
79
+
| Skype | EAF |
80
+
| SolarWinds Syslogd Manager | EAF |
81
+
| Windows Media Player | MandatoryASLR, EAF|
82
+
83
+
ǂ EMET mitigations might be incompatible with Oracle Java when they're run by using settings that reserve a large chunk of memory for the virtual machine (that is, by using the -Xms option).
35
84
36
85
## Enable exploit protection for testing
37
86
@@ -45,12 +94,14 @@ You can set mitigations in a testing mode for specific programs by using the Win
45
94
46
95
3. Go to **Program settings** and choose the app you want to apply protection to:
47
96
48
-
1. If the app you want to configure is already listed, select it and then select **Edit**
49
-
2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
50
-
- Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
51
-
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
97
+
1. If the app you want to configure is already listed, select it and then select **Edit**.
98
+
99
+
2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
52
100
53
-
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in test mode only. You'll be notified if you need to restart the process, app, or Windows.
101
+
- Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
102
+
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
103
+
104
+
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** applies the mitigation in test mode only. You're notified if you need to restart the process, app, or Windows.
54
105
55
106
5. Repeat this procedure for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration.
56
107
@@ -93,7 +144,7 @@ You can disable **audit mode** by replacing `-Enable` with `-Disable`.
93
144
94
145
## Review exploit protection audit events
95
146
96
-
To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.<br/><br/>
147
+
To review which apps would be blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.
97
148
98
149
|Feature|Provider/source|Event ID|Description|
99
150
|---|---|--|---|
@@ -110,4 +161,5 @@ To review which apps would have been blocked, open Event Viewer and filter for t
110
161
-[Configure and audit exploit protection mitigations](customize-exploit-protection.md)
111
162
-[Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
title: CloudProcessEvents table in the advanced hunting schema
3
+
description: Learn about the CloudProcessEvents table in the advanced hunting schema, which contains information about process events in multicloud hosted environments.
The `CloudProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about process events in multicloud hosted environments such as Azure Kubernetes Service, Amazon Elastic Kubernetes Service, and Google Kubernetes Engine. Use this reference to construct queries that return information from this table.
32
+
33
+
> [!IMPORTANT]
34
+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35
+
36
+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
37
+
38
+
| Column name | Data type | Description |
39
+
|-------------|-----------|-------------|
40
+
|`Timestamp`|`datetime`| Date and time when the event was recorded |
41
+
|`AzureResourceId`|`string`| Unique identifier of the Azure resource associated with the process |
42
+
|`AwsResourceName`|`string`| Unique identifier specific to Amazon Web Services devices, containing the Amazon resource name|
43
+
|`GcpFullResourceName`|`string`| Unique identifier specific to Google Cloud Platform devices, containing a combination of zone and ID for GCP |
44
+
|`ContainerImageName`|`string`| UThe container image name or ID, if it exists |
45
+
|`KubernetesNamespace`|`string`| The Kubernetes namespace name |
46
+
|`KubernetesPodName`|`string`| The Kubernetes pod name |
47
+
|`KubernetesResource`|`string`| Identifier value that includes namespace, resource type and name |
48
+
|`ContainerName`|`string`| Name of the container in Kubernetes or another runtime environment |
49
+
|`ContainerId`|`string`| The container identifier in Kubernetes or another runtime environment|
50
+
|`ActionType`|`string`| Type of activity that triggered the event. See the in-portal schema reference for details.|
51
+
|`FileName`|`string`| Name of the file that the recorded action was applied to |
52
+
|`FolderPath`|`string`| Folder containing the file that the recorded action was applied to|
53
+
|`ProcessId`|`long`| Process ID (PID) of the newly created process |
54
+
|`ProcessName`|`string`| The name of the process |
55
+
|`ParentProcessName`|`string`| The name of the parent process |
56
+
|`ParentProcessId`|`string`| The process ID (PID) of the parent process|
57
+
|`ProcessCommandLine`|`string`| Command line used to create the new process|
58
+
|`ProcessCreationTime`|`datetime`| Date and time the process was created |
59
+
|`ProcessCurrentWorkingDirectory`|`string`| Current working directory of the running process |
60
+
|`AccountName`|`string`| User name of the account |
61
+
|`LogonId`|`long`| Identifier for a logon session. This identifier is unique on the same pod or container between restarts. |
62
+
|`InitiatingProcessId`|`string`| Process ID (PID) of the process that initiated the event |
63
+
|`AdditionalFields`|`string`| Additional information about the event in JSON array format |
64
+
65
+
66
+
## Sample queries
67
+
68
+
You can use this table to get detailed information on processes invoked in a cloud environment. The information is useful in hunting scenarios and can discover threats that can be observed through process details, like malicious processes or command-line signatures.
69
+
70
+
You can also investigate security alerts provided by Defender for Cloud that make use of the cloud process events data in advanced hunting to understand details in the process tree for processes that include a security alert.
71
+
72
+
### Process events by command-line arguments
73
+
To hunt for process events including a given term (represented by "x" in the query below) in the command-line arguments:
74
+
75
+
```kusto
76
+
CloudProcessEvents | where ProcessCommandLine has "x"
77
+
```
78
+
79
+
### Rare process events for a pod in a Kuberentes cluster
80
+
To investigate unusual process events invoked as part of a pod in a Kubernetes cluster:
81
+
82
+
```kusto
83
+
CloudProcessEvents | where AzureResourceId = "x" and KubernetesNamespace = "y" and KubernetesPodName = "z" | summarize count() by ProcessName | top 10 by count_ asc
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-schema-tables.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,8 @@ The following reference lists all the tables in the schema. Each table name link
61
61
|**[BehaviorEntities](advanced-hunting-behaviorentities-table.md)** (Preview) | Behavior data types in Microsoft Defender for Cloud Apps (not available for GCC) |
62
62
|**[BehaviorInfo](advanced-hunting-behaviorinfo-table.md)** (Preview) | Alerts from Microsoft Defender for Cloud Apps (not available for GCC) |
63
63
|**[CloudAppEvents](advanced-hunting-cloudappevents-table.md)**| Events involving accounts and objects in Office 365 and other cloud apps and services |
64
-
|**[CloudAuditEvents](advanced-hunting-cloudauditevents-table.md)**| Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
64
+
|**[CloudAuditEvents](advanced-hunting-cloudauditevents-table.md)** (Preview) | Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
65
+
|**[CloudProcessEvents](advanced-hunting-cloudprocessevents-table.md)** (Preview)| Cloud process events for various cloud platforms protected by the organization's Microsoft Defender for Containers |
65
66
|**[DeviceEvents](advanced-hunting-deviceevents-table.md)**| Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection |
66
67
|**[DeviceFileCertificateInfo](advanced-hunting-DeviceFileCertificateInfo-table.md)**| Certificate information of signed files obtained from certificate verification events on endpoints |
67
68
|**[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)**| File creation, modification, and other file system events |
Copy file name to clipboardExpand all lines: defender-xdr/whats-new.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,6 +31,7 @@ You can also get product updates and important notifications through the [messag
31
31
32
32
## November 2024
33
33
- (GA) The `arg()` operator in [advanced hunting](advanced-hunting-defender-use-custom-rules.md#use-arg-operator-for-azure-resource-graph-queries) in Microsoft Defender portal is now generally available. Users can now use the *arg()* operator for Azure Resource Graph queries to search over Azure resources, and no longer need to go to Log Analytics in Microsoft Sentinel to use this operator if already in Microsoft Defender.
34
+
- (Preview) The [CloudProcessEvents](advanced-hunting-cloudprocessevents-table.md) table is now available for preview in advanced hunting. It contains information about process events in multicloud hosted environments. You can use it to discover threats that can be observed through process details, like malicious processes or command-line signatures.
0 commit comments