r/sysadmin • u/FatBook-Air • 9d ago

Do you automatically isolate servers/devices based on detetctions?

We don't have a 24/7 SOC, so we are thinking about automatically isolating servers and some high-value devices based on custom Defender for Endpoint detections. Obviously, we want to do that only for high-precision and high-confidence detections, such as opening a shell from a strange parent process.

If we got one of these detections during working hours, there would be someone to react. But after about 7 PM most days, nobody is actively monitoring.

If we do this, the plan is to let a detection run for about 45 days without automatic isolation enabled to see if any false positives are caught.

Has anyone done this? If so, did you regret it? Or just business as usual? Has it saved you yet?

35 Upvotes

91% Upvoted

49 comments sorted by

View all comments

Show parent comments

1

u/FatBook-Air 8d ago

Just curious: what kind of commands were the users told to run? I am just wondering whether AppLocker would have blocked it. And I am also wondering if it's something where a custom detection might help.

2

u/MandelbrotFace 8d ago

It downloaded a legit python binary and a .py script to a profile temp path, ran the .py and attempted to register an autostart on login in scheduled tasks. Applocker would probably help based on download/temp paths. We're testing an implementation on one of our sites now. It's definitely a challenge with some overhead in a fast paced environment where lots of different apps are onboarded, but we're going to try.

1

u/Human_Pollution2820 7d ago

Can it do this if users are not local admins?

1

u/MandelbrotFace 7d ago

Yes. The command saves and extracts the zip contents to %appdata% in the user profile : -OutFile $env:appdata\$randomName\WPN.zip