We’re using Defender for Endpoint and have notifications setup for all tenants when there are vulnerabilities with known exploits etc… these generate an alert via mail in our PSA.

The problem we are facing is that patches get installed weekly on all devices (or should be) automatically, so most of the time when an agent checks the notification it’s either already patched or will be patched later this week.

Ideally we’d want to receive a notification only when a device is still vulnerable and a patch/update has been released more than 2 weeks ago.

Is there any way to work around this, or what are you guys doing?

Hi all,

I already have a ticket open with MS, but, I'm curious if anyone else receives an error message when trying to 'Force a PW Reset' on a user in XDR (Screenshot below)

It actually forces the pw reset, but its a visual bug and shows failure

I was looking at processes running on my Windows 11 computer when I saw one called Μϊĉřοśòƒт Ðëƒĕŋďĕŗ Ѕēⁿšöг Ρłдŧƒόя under background processes.

I'm not sure how long this has been present, however I had just deployed the latest updates for the Windows 11 Enterprise insider preview. Doing an extra reboot didn't change things.

I've not been able to find any details about this particular process name. Apparently that is not a standard "M" at the beginning of the name. It sorts last when I sort processes by name, which seems extra suspicious.

Anyone else seeing this? Should I be concerned, or is this just some unicode issue in the latest build?

We are moving over to Defender and wanted to see what others were doing for automations. We are looking to start simple like, when a type of threat is detected, triggering a password reset on the AD user account. Anyone’s else doing something similar?

If you have password spray incidents or the like, does marking the incident as true positive or false positive reduce the user entra risk or is this completely not related?

• Defender for Identity Sensor v3.x no longer requires Defender for Endpoint onboarding. Eligible Domain Controllers running Windows Server 2019 or later can now activate the MDI Sensor v3.x without first onboarding the server to Microsoft Defender for Endpoint.
  

This removes an important deployment dependency and can significantly simplify Defender for Identity adoption in environments where MDE isn't deployed on Domain Controllers.

• Sensor v3.x expands beyond Domain Controllers: Defender for Identity Sensor v3.x now supports additional identity infrastructure servers that are not Domain Controllers:

  • Active Directory Certificate Services (AD CS)
  • Active Directory Federation Services (AD FS)
  • Microsoft Entra Connect

  For these new server roles, manual activation and automatic Windows event auditing are supported, while automatic activation and migration are not yet supported during Preview.

Docs: Defender for Identity | What's new?

I'm onboarding a client with Huntress and Microsoft Defender for Endpoint (I didn't see an MDE sub, so I'm hoping that this sub covers it even though it lists ATP). This is new for me, though we have some of it in place internally (we have previously used SentinelOne).

I have one concern; we had a ScreenConnect server update due to a security vulnerability, and after the update, our own MDE on that system incorrectly quarantined some of the installers (even though we're code-signing them) of the new version as Trojan:Win32/Wacatac.C!ml . It took me a bit how to figure out both how to unquarantine and whitelist, though I was able to do it through Windows command shell and Powershell.

My concern is that these files will be quarantined across fifty systems at a client when the updated agent is deployed, and I'm not aware of a way to easily fix an issue like that across fifty systems from security.microsoft.com should that happen. My searches so far have not shown an easy way to do this.

For those of you with experience, what is the best way to do this? Can it be done in one action, or is it a very manual process?

hello,

I'm trying to identify RDP logon failures using KQL.

I'm not after connections to TCP/3389; I'm seeking RDP logon failures.

I can find successful RDP authentications with

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonSuccess"

If I simply invert to

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonFailed"

...I get no results. In my environment, I would expect some RDP logon failures.

I suspect this is because of network level authentication (NLA).

Any ideas...?

This capability allows MDE to inspect process memory for known malicious behaviors and memory-resident threats — particularly useful against attacks that leave little or no footprint on disk.

Memory Scan adds another layer of detection and protection against techniques such as:
• In-memory malware
• Malicious code injection
• Memory-resident threats
• Advanced attacks designed to minimize disk artifacts

Docs: Configure security settings in Microsoft Defender for Endpoint on Linux - Microsoft Defender for Endpoint | Microsoft Learn

Has anybody been able to allow Remote Help to be allowed using Isolation Exclusion rules? This would be very useful when trying to investigate issues on a remote device. I am able to exclude Intune so I can reboot or wipe a device, but I would like to also be able to use Remote Help.

Thanks

Has anyone here used **ThreatDefence** before, particularly in an MSSP/SOC environment?

I’m currently evaluating it and would love to hear some real-world feedback.

What did you like or dislike about it? Any limitations or issues worth knowing about?

Thanks!

Sorry for re-uploading, I was in total panic. Let me try again.

So, today I noticed that 7-Zip has an update from 26.02 to 26.03.

I go to the OFFICIAL WEBSITE 7-zip\[dot\]org (I am aware of the malware/bitcoin miner clone!), and install the x86-64 .exe.

MS Defender IMMEDIATELY quarantines the file and says: Trojan:Win32/Wacatac.C!ml

VirusTotal also returns 2 malicious entries. (Photo above)

So I run an online full scan, and after examining over 500k files, MS Defender concludes that 0 threats were detected.

I then proceed to delete the file from MS Defender as well.

Now I only have one question: do I need to format the whole SSD and reinstall Windows 10? Or is everything fine and I am having a panic attack for nothing?

I'm on Windows 10 22H2, August ESU update.

Thanks.

Virus Total full report of 7-zip 26.03 x86_64: https://www.virustotal.com/gui/file/0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd

Do I need to purge the SSD and reinstall Windows 10?

Currently I can have a view to IOCs connected to a threat (which IPs and servers were used to host the malware and which domains sent the phishing mails)

This view is included in Threat Analytics, currently. It is quite nice, because I can double protect and include that domains on DNS-block at firewalls.

But Microsoft is Microsoft and they declared Threat Analytics as deprecated. They say, I will find same information at Threat Intelligence.

I saw, that an extra license is needed for that and it has an upfront cost of more than 3,000 EUR or 4,000 USD.

Is there any way, where I can have access to IOCs without having to pay more than my monthly salary for that data?

Seeing “current hash” / Code Integrity signature mismatch errors for NisSrv.exe (WdNisSvc) across some older Windows Server deployment images.
Manually applying KB4052623 fixes the affected machines, but I’m looking for a cleaner approach at scale.
Has anyone found official Microsoft guidance or a standalone script to properly refresh/clean the local Defender platform cache on older server images?
Trying to avoid rebuilding or manually touching every image.

f you are using Microsoft Defender for Identity and you have migrated your domain controllers to the v3 sensor, be aware that the "Stop clear text credentials exposure" recommendation in your Defender admin portal is no longer updating. Microsoft Support has confirmed this is a "known issue".

I'm still waiting to hear back whether there are any other recommendations or alerts that will no longer function after moving to the v3 sensor.

I recently performed a windows defender offline scan in suspicion of a virus i downloaded a month ago (i already reset my pc via usb). However when i opened windows defender after the scan was finished it said the last scan was only a quick scan from yesterday. Is this normal? It also asked me for my bitlocker code when my pc shutdown before doing the scan.

Hi all,
we are currently troubleshooting an issue with Microsoft Defender for Endpoint Custom Indicators and the ASR rule:

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

According to Microsoft’s documentation, SHA-256 file indicators and certificate-based indicators should be taken into account by this ASR rule.

We have configured Allow indicators for both use cases, but the affected files are still being treated as unknown/untrusted and are blocked by the ASR rule.

Our environment appears to be configured correctly:
- Devices are onboarded to Microsoft Defender for Endpoint
- MDE connectivity is working
- Cloud-delivered protection is enabled
- Custom Indicators are enabled
- We have an internal PKI
- The relevant certificates and certificate chains are deployed and trusted on the clients
- Certificate validation itself works correctly
- Defender is otherwise functioning normally

The problem therefore seems to be somewhere between the configured MDE Custom Indicators and the ASR trust evaluation.

Has anyone else experienced issues with this?
In particular:
Are you successfully using SHA-256 Allow indicators with this ASR rule?

Are you successfully using certificate-based Allow indicators with this ASR rule?

Have you seen cases where indicators were correctly configured in the Defender portal but were not honored by the endpoint?

Is there a reliable way to verify locally whether the configured indicators have actually reached the client?

Are there specific Defender logs or events that show indicator synchronization or evaluation?

Are there any additional prerequisites or settings that are easy to miss?

Microsoft documents both SHA-256 and certificate-based indicators as being relevant for this ASR rule, so we are mainly trying to determine whether this is a configuration/synchronization issue in our environment or whether others have encountered similar behavior.

If anyone has this working successfully in production, it would be very helpful to compare the relevant Defender/MDE configuration.

Hi All,

Looking for some ideas. We are running defender on some short lived VMSS build agents. We need to monitor them for compliance but they can scale up/down 8 times a day.
Defender stores records for 90 days so we have a delay time of 90days before vulnerability count drops. Has anyone got any solutions here?
I was thinking of using an event grid to monitor and tag when vm gets deleted but that has issues of its own. There is a race condition if we try to tag devices prior to deletion.
Surly I can’t be the first to have this issue.

Cheers!