Skip to content

Commit bc02722

Browse files
committed
Merge branch 'main' into maccruz-contextpane
2 parents bc58cd3 + 50c6030 commit bc02722

File tree

43 files changed

+306
-197
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+306
-197
lines changed

defender-endpoint/attack-surface-reduction-rules-reference.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -574,6 +574,14 @@ Configuration Manager name: Not yet available
574574

575575
GUID: `33ddedf1-c6e0-47cb-833e-de6133960387`
576576

577+
Advanced hunting action type:
578+
579+
- `AsrSafeModeRebootedAudited`
580+
581+
- `AsrSafeModeRebootBlocked`
582+
583+
- `AsrSafeModeRebootWarnBypassed`
584+
577585
Dependencies: Microsoft Defender Antivirus
578586

579587
### Block untrusted and unsigned processes that run from USB
@@ -611,6 +619,14 @@ Configuration Manager name: Not yet available
611619

612620
GUID: `c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb`
613621

622+
Advanced hunting action type:
623+
624+
- `AsrAbusedSystemToolAudited`
625+
626+
- `AsrAbusedSystemToolBlocked`
627+
628+
- `AsrAbusedSystemToolWarnBypassed`
629+
614630
Dependencies: Microsoft Defender Antivirus
615631

616632
### Block Webshell creation for Servers

defender-endpoint/edr-block-mode-faqs.yml

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ metadata:
1515
- partner-contribution
1616
ms.topic: faq
1717
ms.collection: m365-security
18-
ms.date: 04/26/2024
18+
ms.date: 09/07/2024
1919

2020
title: Endpoint detection and response (EDR) in block mode frequently asked questions (FAQ)
2121
summary: |
@@ -38,14 +38,12 @@ sections:
3838
- question: |
3939
Do I need to turn EDR in block mode on if I have Microsoft Defender Antivirus running on devices?
4040
answer: |
41-
Yes, Microsoft recommends enabling EDR in block mode, even when primary antivirus software on the system is Microsoft Defender Antivirus. EDR detections can be automatically remediated by [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) or by [automated investigation & remediation capabilities](automated-investigations.md) in block mode.
42-
43-
The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product.
41+
Yes, Microsoft recommends enabling EDR in block mode, even when primary antivirus software on the system is Microsoft Defender Antivirus. The primary purpose of EDR in block mode is to remediate post-breach detections that were missed by a non-Microsoft antivirus product. However, there are scenarios where EDR in block mode might be beneficial, such as if Microsoft Defender Antivirus is misconfigured, or if [PUA protection](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) is not enabled. In such cases, EDR in block mode can automatically remediate detections like PUA.
4442
4543
- question: |
4644
Will EDR in block mode affect a user's antivirus protection?
4745
answer: |
48-
EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like Microsoft Defender Antivirus in passive mode, except that EDR in block mode also blocks and remediates malicious artifacts or behaviors that are detected.
46+
EDR in block mode does not affect non-Microsoft antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like Microsoft Defender Antivirus in passive mode, except that EDR in block mode also blocks and remediates malicious artifacts or behaviors that are detected.
4947
5048
- question: |
5149
Why do I need to keep Microsoft Defender Antivirus up to date?

defender-endpoint/linux-preferences.md

Lines changed: 41 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -861,40 +861,15 @@ The following configuration profile contains entries for all settings described
861861

862862
```JSON
863863
{
864-
"antivirusEngine":{
865-
"enforcementLevel":"real_time",
866-
"behaviorMonitoring": "enabled",
864+
"antivirusEngine":{
865+
"enforcementLevel":"passive",
866+
"behaviorMonitoring": "disabled",
867867
"scanAfterDefinitionUpdate":true,
868868
"scanArchives":true,
869869
"scanHistoryMaximumItems": 10000,
870870
"scanResultsRetentionDays": 90,
871871
"maximumOnDemandScanThreads":2,
872872
"exclusionsMergePolicy":"merge",
873-
"exclusions":[
874-
{
875-
"$type":"excludedPath",
876-
"isDirectory":false,
877-
"path":"/var/log/system.log<EXAMPLE DO NOT USE>"
878-
},
879-
{
880-
"$type":"excludedPath",
881-
"isDirectory":true,
882-
"path":"/run<EXAMPLE DO NOT USE>"
883-
},
884-
{
885-
"$type":"excludedPath",
886-
"isDirectory":true,
887-
"path":"/home/*/git<EXAMPLE DO NOT USE>"
888-
},
889-
{
890-
"$type":"excludedFileExtension",
891-
"extension":".pdf<EXAMPLE DO NOT USE>"
892-
},
893-
{
894-
"$type":"excludedFileName",
895-
"name":"cat<EXAMPLE DO NOT USE>"
896-
}
897-
],
898873
"allowedThreats":[
899874
"<EXAMPLE DO NOT USE>EICAR-Test-File (not a virus)"
900875
],
@@ -904,6 +879,7 @@ The following configuration profile contains entries for all settings described
904879
],
905880
"nonExecMountPolicy":"unmute",
906881
"unmonitoredFilesystems": ["nfs,fuse"],
882+
"enableFileHashComputation": false,
907883
"threatTypeSettingsMergePolicy":"merge",
908884
"threatTypeSettings":[
909885
{
@@ -914,14 +890,49 @@ The following configuration profile contains entries for all settings described
914890
"key":"archive_bomb",
915891
"value":"audit"
916892
}
917-
]
893+
],
894+
"scanFileModifyPermissions":false,
895+
"scanFileModifyOwnership":false,
896+
"scanNetworkSocketEvent":false,
897+
"offlineDefinitionUpdateUrl": "http://172.22.199.67:8000/linux/production/<EXAMPLE DO NOT USE>",
898+
"offlineDefintionUpdateFallbackToCloud":false,
899+
"offlineDefinitionUpdate":"disabled"
918900
},
919901
"cloudService":{
920902
"enabled":true,
921903
"diagnosticLevel":"optional",
922904
"automaticSampleSubmissionConsent":"safe",
923905
"automaticDefinitionUpdateEnabled":true,
924-
"proxy": "<EXAMPLE DO NOT USE> http://proxy.server:port/"
906+
"proxy": "<EXAMPLE DO NOT USE> http://proxy.server:port/",
907+
"definitionUpdatesInterval":28800
908+
},
909+
"features":{
910+
"moduleLoad":"disabled",
911+
"supplementarySensorConfigurations":{
912+
"enableFilePermissionEvents":"disabled",
913+
"enableFileOwnershipEvents":"disabled",
914+
"enableRawSocketEvent":"disabled",
915+
"enableBootLoaderCalls":"disabled",
916+
"enableProcessCalls":"disabled",
917+
"enablePseudofsCalls":"diabled",
918+
"enableEbpfModuleLoadEvents":"disabled",
919+
"sendLowfiEvents":"disabled"
920+
},
921+
"ebpfSupplementaryEventProvider":"enabled",
922+
"offlineDefinitionUpdateVerifySig": "disabled"
923+
},
924+
"networkProtection":{
925+
"enforcementLevel":"disabled",
926+
"disableIcmpInspection":true
927+
},
928+
"edr":{
929+
"groupIds":"GroupIdExample",
930+
"tags": [
931+
{
932+
"key": "GROUP",
933+
"value": "Tag"
934+
}
935+
]
925936
},
926937
"exclusionSettings":{
927938
"exclusions":[

defender-endpoint/manage-protection-updates-microsoft-defender-antivirus.md

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.collection:
1414
- m365-security
1515
- tier2
1616
search.appverid: met150
17-
ms.date: 04/08/2024
17+
ms.date: 09/09/2024
1818
---
1919

2020
# Manage the sources for Microsoft Defender Antivirus protection updates
@@ -34,7 +34,7 @@ ms.date: 04/08/2024
3434
Keeping your antivirus protection up to date is critical. There are two components to managing protection updates for Microsoft Defender Antivirus:
3535

3636
- *Where* the updates are downloaded from; and
37-
- *When* updates are downloaded and applied.
37+
- *When* updates are downloaded and applied
3838

3939
This article describes how to specify from where updates should be downloaded (this specification is also known as the fallback order). See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md) article for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
4040

@@ -47,10 +47,10 @@ This article describes how to specify from where updates should be downloaded (t
4747

4848
Typically, you configure endpoints to individually download updates from a primary source followed by other sources in order of priority, based on your network configuration. Updates are obtained from sources in the order you specify. If updates from the current source are out-of-date, the next source in the list is used immediately.
4949

50-
When updates are published, some logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed (the set of differences is referred to as the delta) on the device is downloaded and applied. However, the size of the delta depends on two main factors:
50+
When updates are published, logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed is downloaded and applied to the device. The set of differences is referred to as the *delta*. The size of the delta depends on two main factors:
5151

5252
- The age of the last update on the device; and
53-
- The source used to download and apply updates.
53+
- The source used to download and apply updates
5454

5555
The older the updates on an endpoint, the larger the download is. However, you must also consider download frequency as well. A more frequent update schedule can result in more network usage, whereas a less-frequent schedule can result in larger file sizes per download.
5656

@@ -83,39 +83,39 @@ Each source has typical scenarios that depend on how your network is configured,
8383
|---|---|
8484
|Windows Server Update Service|You're using Windows Server Update Service to manage updates for your network.|
8585
|Microsoft Update|You want your endpoints to connect directly to Microsoft Update. This option is useful for endpoints that irregularly connect to your enterprise network, or if you don't use Windows Server Update Service to manage your updates.|
86-
|File share|You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares are used in virtual desktop infrastructure (VDI) environments.|
86+
|File share|You have devices that aren't connected to the Internet (such as virtual machines, or VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares are used in virtual desktop infrastructure (VDI) environments.|
8787
|Microsoft Configuration Manager|You're using Microsoft Configuration Manager to update your endpoints.|
88-
|Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates and platform updates are SHA-2 signed exclusively. <br/>Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It's only be used if updates can't be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](manage-outdated-endpoints-microsoft-defender-antivirus.md#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
88+
|Security intelligence updates and platform updates for Microsoft Defender Antivirus and other Microsoft anti-malware (formerly referred to as MMPC)|[Make sure devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence and platform updates are delivered through Windows Update. As of October 21, 2019, security intelligence updates and platform updates are SHA-2 signed exclusively. <br/>Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should be used only as a final fallback source, and not the primary source. It's only to be used if updates can't be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](manage-outdated-endpoints-microsoft-defender-antivirus.md#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
8989

9090
You can manage the order in which update sources are used with Group Policy, Microsoft Endpoint Configuration Manager, PowerShell cmdlets, and WMI.
9191

9292
> [!IMPORTANT]
9393
> If you set Windows Server Update Service as a download location, you must approve the updates, regardless of the management tool you use to specify the location. You can set up an automatic approval rule with Windows Server Update Service, which might be useful as updates arrive at least once a day. To learn more, see [synchronize endpoint protection updates in standalone Windows Server Update Service](/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus).
9494
95-
The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it.
95+
The procedures in this article first describe how to set the order, and then how to set up the **File share** option if it's enabled.
9696

9797
## Use Group Policy to manage the update location
9898

99-
1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and then select **Edit**.
99+
1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). Right-click the Group Policy Object you want to configure and then select **Edit**.
100100

101-
2. In the **Group Policy Management Editor**, go to **Computer configuration**.
101+
1. In the **Group Policy Management Editor**, go to **Computer configuration**.
102102

103-
3. Select **Policies** then **Administrative templates**.
103+
1. Select **Policies** then **Administrative templates**.
104104

105-
4. Expand the tree to **Windows components** \> **Windows Defender** \> **Signature updates** and then configure the following settings:
105+
1. Expand the tree to **Windows components** > **Windows Defender** > **Signature updates** and then configure the following settings:
106106

107107
1. Edit the **Define the order of sources for downloading security intelligence updates** setting. Set the option to **Enabled**.
108-
108+
109109
2. Specify the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
110110

111111
:::image type="content" source="/defender/media/wdav-order-update-sources.png" alt-text="Group policy setting listing the order of sources" lightbox="/defender/media/wdav-order-update-sources.png":::
112112

113-
3. Select **OK**. This action sets the order of protection update sources.
114-
115-
4. Edit the **Define file shares for downloading security intelligence updates** setting and then set the option to **Enabled**.
116-
117-
5. Specify the file share source. If you have multiple sources, specify each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you don't enter any paths, then this source is skipped when the VM downloads updates.
118-
113+
1. Select **OK**. This action sets the order of protection update sources.
114+
115+
1. Edit the **Define file shares for downloading security intelligence updates** setting and then set the option to **Enabled**.
116+
117+
1. Specify the file share source. If you have multiple sources, specify each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you don't enter any paths, then this source is skipped when the VM downloads updates.
118+
119119
6. Select **OK**. This action sets the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
120120

121121
> [!NOTE]
@@ -135,7 +135,7 @@ Set-MpPreference -SignatureFallbackOrder {LOCATION|LOCATION|LOCATION|LOCATION}
135135
Set-MpPreference -SignatureDefinitionUpdateFileSharesSource {\\UNC SHARE PATH|\\UNC SHARE PATH}
136136
```
137137

138-
See the following articles for more information:
138+
For more information, see the following articles:
139139

140140
- [Set-MpPreference -SignatureFallbackOrder](/powershell/module/defender/set-mppreference)
141141
- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSource](/powershell/module/defender/set-mppreference#-signaturedefinitionupdatefilesharessources)
@@ -159,9 +159,9 @@ See the following articles for more information:
159159

160160
See [Policy CSP - Defender/SignatureUpdateFallbackOrder](/windows/client-management/mdm/policy-csp-defender#defender-signatureupdatefallbackorder) for details on configuring MDM.
161161

162-
## What if we're using a third-party vendor?
162+
## What if we're using a non-Microsoft vendor?
163163

164-
This article describes how to configure and manage updates for Microsoft Defender Antivirus. However, you can hire third-party vendors to perform these tasks.
164+
This article describes how to configure and manage updates for Microsoft Defender Antivirus. However, you can hire non-Microsoft vendors to perform these tasks.
165165

166166
For example, suppose that Contoso has hired Fabrikam to manage their security solution, which includes Microsoft Defender Antivirus. Fabrikam typically uses [Windows Management Instrumentation](./use-wmi-microsoft-defender-antivirus.md), [PowerShell cmdlets](./use-powershell-cmdlets-microsoft-defender-antivirus.md), or [Windows command-line](./command-line-arguments-microsoft-defender-antivirus.md) to deploy patches and updates.
167167

@@ -246,7 +246,7 @@ Set up a network file share (UNC/mapped drive) to download security intelligence
246246
> [!NOTE]
247247
> When the scheduled tasks are created, you can find these in the Task Scheduler under `Microsoft\Windows\Windows Defender`.
248248

249-
9. Run each task manually and verify that you have data (`mpam-d.exe`, `mpam-fe.exe`, and `nis_full.exe`) in the following folders (you might have chosen different locations):
249+
9. Run each task manually and verify that you have data (`mpam-d.exe`, `mpam-fe.exe`, and `nis_full.exe`) in the following folders (you might use different locations):
250250

251251
- `C:\Temp\TempSigs\x86`
252252
- `C:\Temp\TempSigs\x64`

0 commit comments

Comments
 (0)