#mde — Public Fediverse posts

https://www.europesays.com/es/564339/ La UME e Iberdrola impulsan su colaboración en formación y simulación virtual para la gestión de emergencias – Unidad Militar de Emergencias #BreakingNews #BreakingNews #EjercitoEspañol #ES #España #FeaturedNews #FeaturedNews #FuerzasArmadas #Headlines #LatestNews #LatestNews #mde #MinisterioDeDefensa #News #Noticias #NoticiasDestacadas #NoticiasDestacadas #ParaServir #Spain #Titulares #ÚltimasNoticias #ÚltimasNoticias #UME #UnidadDeEmergencias #UnidadMilitarDeEmergencias

Hunting CVE-2026-41096 (Windows DNS Client RCE, CVSS 9.8) in Advanced Hunting?

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("dnscache", "NetworkService")
| where FileName !in~ ("conhost.exe", "WerFault.exe", "wermgr.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| order by Timestamp desc

#CVE202641096 #KQL #ThreatHunting #MDE

Hunting CVE-2026-41096 (Windows DNS Client RCE, CVSS 9.8) in Advanced Hunting?

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("dnscache", "NetworkService")
| where FileName !in~ ("conhost.exe", "WerFault.exe", "wermgr.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| order by Timestamp desc

#CVE202641096 #KQL #ThreatHunting #MDE

Hunting CVE-2026-41096 (Windows DNS Client RCE, CVSS 9.8) in Advanced Hunting?

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("dnscache", "NetworkService")
| where FileName !in~ ("conhost.exe", "WerFault.exe", "wermgr.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| order by Timestamp desc

#CVE202641096 #KQL #ThreatHunting #MDE

Hunting CVE-2026-41096 (Windows DNS Client RCE, CVSS 9.8) in Advanced Hunting?

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("dnscache", "NetworkService")
| where FileName !in~ ("conhost.exe", "WerFault.exe", "wermgr.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| order by Timestamp desc

#CVE202641096 #KQL #ThreatHunting #MDE

Hunting CVE-2026-41096 (Windows DNS Client RCE, CVSS 9.8) in Advanced Hunting?

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("dnscache", "NetworkService")
| where FileName !in~ ("conhost.exe", "WerFault.exe", "wermgr.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine
| order by Timestamp desc

#CVE202641096 #KQL #ThreatHunting #MDE

𝐓𝐀𝐌𝐏𝐄𝐑 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 𝐅𝐎𝐑 𝐄𝐗𝐂𝐋𝐔𝐒𝐈𝐎𝐍𝐒 𝐈𝐍 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓

Antivirus exclusions can do a lot of damage because what is in the exclusions is not monitored and possibly blocked. Exclusions should only be put in with great circumspection and there should be as few exclusions as possible.

Threat actors may try to create their own exclusions within various malware to allow them to run other malware and thus extend their control over the device. Therefore, exclusions need to be carefully protected and fully controlled.

📺 Watch my YouTube video bellow on how to enable tamper protection for exclusions in Microsoft Defender for Endpoint 👇 👇
https://youtu.be/8OjuGuGAXiY

#cswrld #mde #tamperprotection #exclusions #videotutorial

𝐓𝐀𝐌𝐏𝐄𝐑 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 𝐅𝐎𝐑 𝐄𝐗𝐂𝐋𝐔𝐒𝐈𝐎𝐍𝐒 𝐈𝐍 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓

Antivirus exclusions can do a lot of damage because what is in the exclusions is not monitored and possibly blocked. Exclusions should only be put in with great circumspection and there should be as few exclusions as possible.

Threat actors may try to create their own exclusions within various malware to allow them to run other malware and thus extend their control over the device. Therefore, exclusions need to be carefully protected and fully controlled.

📺 Watch my YouTube video bellow on how to enable tamper protection for exclusions in Microsoft Defender for Endpoint 👇 👇
https://youtu.be/8OjuGuGAXiY

#cswrld #mde #tamperprotection #exclusions #videotutorial

𝐓𝐀𝐌𝐏𝐄𝐑 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 𝐅𝐎𝐑 𝐄𝐗𝐂𝐋𝐔𝐒𝐈𝐎𝐍𝐒 𝐈𝐍 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓

Antivirus exclusions can do a lot of damage because what is in the exclusions is not monitored and possibly blocked. Exclusions should only be put in with great circumspection and there should be as few exclusions as possible.

Threat actors may try to create their own exclusions within various malware to allow them to run other malware and thus extend their control over the device. Therefore, exclusions need to be carefully protected and fully controlled.

📺 Watch my YouTube video bellow on how to enable tamper protection for exclusions in Microsoft Defender for Endpoint 👇 👇
https://youtu.be/8OjuGuGAXiY

#cswrld #mde #tamperprotection #exclusions #videotutorial

𝐓𝐀𝐌𝐏𝐄𝐑 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 𝐅𝐎𝐑 𝐄𝐗𝐂𝐋𝐔𝐒𝐈𝐎𝐍𝐒 𝐈𝐍 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓

Antivirus exclusions can do a lot of damage because what is in the exclusions is not monitored and possibly blocked. Exclusions should only be put in with great circumspection and there should be as few exclusions as possible.

Threat actors may try to create their own exclusions within various malware to allow them to run other malware and thus extend their control over the device. Therefore, exclusions need to be carefully protected and fully controlled.

📺 Watch my YouTube video bellow on how to enable tamper protection for exclusions in Microsoft Defender for Endpoint 👇 👇
https://youtu.be/8OjuGuGAXiY

#cswrld #mde #tamperprotection #exclusions #videotutorial

Yesterday I wrote a blog post about Microsoft Defender for Endpoint (#MDE) #Tamper #Protection.

Did you know that tamper protection can protect also #antivirus #exclusions and not only the MDE service itself so that nobody can manipulate with the exclusions? Read my latest blog post on how to enabled tamper protection for exclusions. #cybersecurity #cyberawareness #tips https://www.cswrld.com/2023/11/tamper-protection-for-exclusions-in-microsoft-defender-for-endpoint/

Yesterday I wrote a blog post about Microsoft Defender for Endpoint (#MDE) #Tamper #Protection.

Did you know that tamper protection can protect also #antivirus #exclusions and not only the MDE service itself so that nobody can manipulate with the exclusions? Read my latest blog post on how to enabled tamper protection for exclusions. #cybersecurity #cyberawareness #tips https://www.cswrld.com/2023/11/tamper-protection-for-exclusions-in-microsoft-defender-for-endpoint/

Yesterday I wrote a blog post about Microsoft Defender for Endpoint (#MDE) #Tamper #Protection.

Did you know that tamper protection can protect also #antivirus #exclusions and not only the MDE service itself so that nobody can manipulate with the exclusions? Read my latest blog post on how to enabled tamper protection for exclusions. #cybersecurity #cyberawareness #tips https://www.cswrld.com/2023/11/tamper-protection-for-exclusions-in-microsoft-defender-for-endpoint/

Yesterday I wrote a blog post about Microsoft Defender for Endpoint (#MDE) #Tamper #Protection.

Did you know that tamper protection can protect also #antivirus #exclusions and not only the MDE service itself so that nobody can manipulate with the exclusions? Read my latest blog post on how to enabled tamper protection for exclusions. #cybersecurity #cyberawareness #tips https://www.cswrld.com/2023/11/tamper-protection-for-exclusions-in-microsoft-defender-for-endpoint/

25settembre giornata mondiale dei #Sogni
Da #MdE, l'articolo di Deianira Amico:

"La figura del dormiente. Lettura di un'iconografia diffusa negli anni tra le due guerre"

indaga sulla rappresentazione del #sonno, ricorrente nel movimento #Corrente.
La figura del dormiente permette di affrontare temi come la privazione della libertà e la resistenza, in risposta all'ideologia efficientista del #fascismo.

⬇️ https://riviste.unimi.it/index.php/MdE/article/view/24680?mtm_campaign=mastodon
@cultura #arte #pittura #iconografia

Цифровое Домостроительство: Дерево новой этики

[ Аудиоверсия статьи ] Открытое обращение к духовным лидерам, хранителям традиций и наставникам общин От: Valeri Rakitine , Founder / Incorporator, NPO Eco-Programming Alliance (Canada) Уважаемые духовные лидеры, Я пишу вам как инженер, который всю жизнь создавал невидимые конструкции. Сегодня человечество возделывает новое поле — цифровое пространство. На нём растут системы, которые управляют нашей связью, памятью, финансами и критически важными решениями. Но я вижу, что на этом поле всё чаще всходят болезненные растения: они быстро растут, выглядят мощно — и при этом истощают землю. Я обращаюсь к вам, чтобы описать Дерево новой этики , которое нам необходимо вырастить вместе — от Семени (The Seed) до Плодов .

https://habr.com/ru/articles/1002514/

#vaop #mde #fsm #MLS #MSI

Last week "Quality of Life Research" #ISOQOL published 4 papers:
https://link.springer.com/journal/11136/online-first

For example,

#participatory item development & #IRT evaluation of the Vancouver Airways #Health Literacy Tool
https://rdcu.be/dgW5x
#Psychometrics

#HRQL among homeless individuals in Germany during the #COVID19 pandemic
https://link.springer.com/article/10.1007/s11136-023-03455-5

Secondary pooled analysis of the patient-reported outcomes in the ASPIRE I + II #RCTs in people living with #MDE
https://link.springer.com/article/10.1007/s11136-023-03451-9
#NCT03039192 NCT03097133

🏆LARGEST #UML #modeling and #lowcode #editor in the world 🏆

I'm sure you've never seen a larger UML model in your life. Grab BESSER to draw your own models (and generate full applications from them) for free (big screens not included 😉).

You'll need to wait a little bit to get more context on this picture. Don't want to spoil the surprise!

Thanks to the best #unpaid #supporting #actors Iván Alfonso Aaron David Conrardy Armen Sulejmani for helping

#guinness #guinnessrecord #nocode #gui #mde

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐂𝐥𝐨𝐮𝐝 𝐋𝐚𝐛𝐬

Our labs project help you get ramped up with Microsoft Defender for Cloud and provide hands-on practical experience for product features, capabilities, and scenarios. The labs are divided into 3 main tracks, a beginner (level 100/200) and an advanced (level 300+) track. The labs contain several modules cover different pillars such as Cloud Security Posture Management (CSPM) to Cloud Workload Protection (CWP). To start using our labs, you will need to create Azure Trial Subscription which provides you all capabilities for 30 days – so you have to finish this lab at this point to take advantage of the free trial.

https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Labs

#defender #defenderforcloud #cnapp #cspm #cwp #cwpp #cloudsecurity #multicloud #azure #aws #gcp #microsoft #microsoftsecurity #soc #server #container #storage #dns #api #devops #database #api #github #arc #agentless #storageaccount #mde #vulnerability #mdvm #siem

Этическая идентичность программистов: как навигация в мире эко-программирования в условиях технологического прогресса

В стремительно развивающейся индустрии разработки программного обеспечения появляется новое измерение идентичности: оно сосредоточено вокруг экологической ответственности и устойчивого развития. Как инициатор Eco-Programming Alliance, я обнаружил, что программисты всё чаще сталкиваются с необходимостью интеграции экологически осознанных практик в свою работу, что порождает этические дилеммы, связанные с влиянием их кода на окружающую среду. Эта статья исследует, как идентичность программистов, формируемая их культурным, профессиональным и этическим фоном, эволюционирует в ответ на глобальный экологический кризис. Эко-программирование даёт разработчикам возможность пересмотреть свои роли не только как создателей эффективного кода, но и как хранителей планеты, учитывающих долгосрочные последствия своих решений для устойчивости. Приняв эко-программирование, разработчики не только следуют лучшим практикам, но и формируют новую идентичность, ориентированную на глобальную устойчивость. Как человек, который продвигает Eco-Programming Alliance, я считаю важным подчеркнуть, как программные технологии непосредственно влияют на окружающую среду и как мы, как глобальное сообщество, можем работать над созданием более экологичных практик разработки программного обеспечения.

https://habr.com/ru/articles/848884/

#mde #vaop #epa

Running Ubuntu 26.04 LTS as a daily driver, enrolled in Microsoft Intune with MDE, and it just works.

Linux endpoint management has come a long way. Zero friction, full compliance.

#Ubuntu #Intune #MDE #Linux #EndpointSecurity #Microsoft

📣📢 Announcing the 1st edition of the #workshop on #Quantum #Modeling, co-located with MODELS'26

Join us to explore the combination of quantum for model-driven engineering and #MDE for the development of quantum #hybrid systems

Beyond paper presentations, we plan to have a session to discuss and write down together a roadmap for this exciting area! 🤯

Details: ➡️ ➡️➡️ https://quantum-modeling-workshop.github.io/

Payload: luad.exe (family: Alevaul)
SHA256: 88ec32a311b56441cfe6126b7780f073f36dfb8808de0dab9219d1a0be9c01ac
VT: https://www.virustotal.com/gui/file/88ec32a311b56441cfe6126b7780f073f36dfb8808de0dab9219d1a0be9c01ac
#MDE #Malware #IOC

⚠️ Heads up #infosec community
Found a malicious GitHub repo posing as a curated list of cybersecurity Telegram channels.
Every link in the README points to the same ZIP payload containing luad.exe (malware family: Alevaul). Detected by Microsoft Defender before execution.
VT 0/91 on URL but MDE flagged it as True Positive. Classic evasion.
🔗 https://github.com/simplefastfunnels254/tg-cybersec
Reported to GitHub under Active Malware / DSA Article 16.
#CyberSecurity #ThreatIntel #MDE #Malware #GitHub #OSINT

Update 🧵
Rules ARE active, Event ID 1121 confirms blocking (WmiPrvSE → HPFirmwareInstaller blocked, LSASS protection firing daily).
But Get-MpPreference returns empty, registry key missing. TVM can't detect them → Secure Score stuck at 22/22 exposed.
Anyone seen this before? #MDE #Intune #DefenderForEndpoint

Weird Intune/MDE issue 🧵
ASR policy (Block PSExec/WMI) shows 38 Succeeded in Intune, but Get-MpPreference returns empty on endpoints and registry key doesn't exist.
AttackSurfaceReductionRules_ProviderSet = 1 in PolicyManager but no actual rule values written anywhere.
Cloud-only, no SCCM. Anyone seen this? #MicrosoftDefender #Intune #MDE

From PDF to LMS-Ready Assessments: Combining LLMs and Model-Driven Engineering

https://modeling-languages.com/from-pdf-to-lms-ready-assessments-combining-llms-and-model-driven-engineering/

#pdf #qti #lms #learning #mde

Giornata della #Memoria
Il #27gennaio 1945 l'Armata Rossa libera il campo di sterminio di #auschwitz
Luca Melchiorre su #MaterialiDiEstetica #MdE propone uno studio sulla colpa nelle riflessioni del filosofo #KarlJaspers e di #PrimoLevi.
Quattro sono gli ambiti della colpa analizzati da Jaspers: criminale, politico, morale e metafisico.
La colpa sussiste quando non si fa tutto il possibile per impedire un'ingiustizia o un delitto, rendendo possibile il male

⬇️ https://riviste.unimi.it/index.php/MdE/article/view/29630/?mtm_campaign=mastodon

@cultura

#BlueMonday

Il terzo lunedì dell'anno è spesso definito il giorno più triste. Ma è davvero così? In realtà, questa idea non ha basi scientifiche ed è una strategia di marketing che fa leva sulle #emozioni. Nell’esperienza artistica, però, la dimensione emotiva è uno stimolo potente: le emozioni negative hanno un ruolo centrale nella creazione e nella fruizione dell’#arte, come approfondito in #MdE.

⬇️ Disponibile qui in #OpenAccess: https://riviste.unimi.it/index.php/MdE/article/view/27739?mtm_campaign=mastodon

@cultura

Trustworthy experimentation для B2C: как перестать угадывать в A/B‑тестах

В продуктовой аналитике легко дойти до того момента, когда экспериментов много, а доверия к результатам все меньше и меньше: тесты закрывают “когда стало понятно”, p-value проверяют чуть ли не каждый день (принимая преждевременные решения), MDE забывают фиксировать, а денежные метрики зашумлены так, что выводы получаются, мягко говоря, спорные. В этой статье я показываю практический каркас для более надежных A/B-тестов в B2C: как делать анализ мощности и размера выборки для конверсии и ARPU, как интерпретировать кривую мощности анализа теста и trade-off между MDE, длительностью и доступным трафиком, и почему ratio-метрики вроде выручки на сессию часто лучше голого ARPU. Отдельно разбираю линеаризацию ratio-метрик: как привести их к user-level значениям, чтобы применять стандартные тесты корректнее и стабильнее.

https://habr.com/ru/articles/978702/

#анализ_мощности #размер_выборки #MDE #конверсия #ARPU #ratioметрики #линеаризация #ttest #продуктовая_аналитика #abтестирование

Aviation weather for Jose Maria Córdova International airport in Medellín area (Colombia) is “SKRG 071600Z VRB03KT 9999 BKN050 19/13 Q1027” : See what it means on https://www.bigorre.org/aero/meteo/skrg/en #josemariacordovainternationalairport #airport #medellin #colombia #skrg #mde #metar #aviation #aviationweather #avgeek vl

I don't talk enough about DRUIDE, the language for articulating design uncertainty that @mounadhaouadi designed for her MSc thesis. It's a very good synthesis of concepts for describing the uncertainty that people have during the process of modelling.

Here is the paper, and there is even a 1 minute video of me talking about it: https://www.jot.fm/contents/issue_2021_03/article3.html

#uncertainty #deepUncertainty #MDE #softwareEngineering @seresearchers #SEResearchers

Model-context-protocol server implementation for the BESSER #opensource #lowcode tool https://github.com/BESSER-PEARL/BESSER-MCP-Server

#mcp #mde #modeling

#21ottobre giornata mondiale dell' #ascolto

Nelle opere d'arte, la rappresentazione e il principio ritmico-musicale vengono considerati dalle #neuroscienze come due aspetti che consentono l'identificazione psicofisica con l'altro.
Di questo ci parla Nicola Vitale su #Mde #MaterialidiEsteticanell'articolo :

"Empatia e percezione estetica. Lo "spirito della musica" come principio unificatore"

⬇️ https://riviste.unimi.it/index.php/MdE/article/view/29623?mtm_campaign=mastodon

#empatia #musica

@cultura

📌 Funktionelle Gleichstellung: Teilverlust zählt wie Totalverlust. Das Gericht erkennt trotz verbliebenem Daumenstumpf eine 20%ige Minderung der Erwerbsfähigkeit an – funktionale Einschränkungen überwiegen anatomische Messwerte. #Sozialrecht #Unfallversicherung #MdE

https://www.sozialrechtsiegen.de/funktionelle-gleichstellung-nach-daumenverlust-20-mde-statt-15/

🥰 Always happy to get this feedback from users 🥰:

"We have just started our MDE course, and we are adopting BESSER as the supporting framework. Yesterday we had the first class, and it was easy for students to start modeling (so much more than when using EMF"

And with them, we have already 20 universities using BESSER to teach #mde #uml #modeling

Do you want to be next? We'll help! ➡️ https://lowcode-book.com/book-users/

#emf #online #editor #modeldriven #lowcode #oss #free

Find the detailed CfP of this Theme Section here: www.sosym.org/theme_sectio... #LLMs #SoftwareEngineering #Modeling #MDE

sosym.org/theme_sections...

The experience of managing Microsoft Defender for Endpoint is, quite frankly, so bad as to be bordering upon violence upon my person.

Who f"£$%! designs these things? #infosec #MDE

Как в Авито разработали метрику для поиска распространённых проблем крупных пользователей

Привет! Меня зовут Яша Финкельберг, я senior аналитик в Авито . Здесь мы постоянно следим за удовлетворённостью продавцов и покупателей площадки и ищем способы улучшать их взаимодействие с Авито. Чтобы находить более детальные драйверы, сегментировать запросы и ставить предсказуемые цели в работе с обращениями, мы решили разработать собственную метрику для работы с опытом пользователей — weighted contact rate (wCR) . В статье я расскажу, почему мы решили дополнить существующие метрики нашей, и дам пайплайн разработки, по которому уже вы сможете внедрить что-то подобное у себя в компании. Текст будет полезен аналитикам крупных компаний.

https://habr.com/ru/companies/avito/articles/929932/

#uxисследования #sql #mde #customer_support #ces #avito #авито #аналитика #analytics

📖 While I mostly publicize my #lowocode #handbook now, our #modeldriven #book is still pushing strong 💪.

We're approaching 150 institutions #worldwide using the book. Latest one is an #MDE course by Mert Ozkaya at Yeditepe University (number 141).

With both books you can cover any #modeling, #DSL, #lowcode, #codegeneration, #modeldriven... topic. Pick the one that works best for you. Or even better, pick both ! 😜

🔗 https://mdse-book.com/

🔗 https://lowcode-book.com/

@sadmin @heisec
Ich bekomme echt Schleudertrauma vom permanenten Kopfschütteln! 🤦🏻‍♂️
#Microsoft #Vulnerabilities #fail #Defender #MDE #enshittification
🚮

Il #31gennaio 1942 nasceva a Londra l'attore e regista #DerekJarman.
Lo ricordiamo con un articolo di #MdE dedicato a #Blue, #film del 1993 considerato il suo congedo per la scelta anticonvenzionale di utilizzare una sola inquadratura: uno schermo blu come simbolo dell'avanzamento della #malattia che gli impedisce, tra gli altri sintomi, di vedere altro rispetto a un’ininterrotta distesa di blu.

L'articolo è disponibile in #OpenAccess qui:

⬇️ https://riviste.unimi.it/index.php/MdE/article/view/20679?mtm_campaign=mastodon

𝗛𝗼𝘄 𝘁𝗼 𝗯𝗹𝗼𝗰𝗸 𝗻𝗲𝘄𝗹𝘆 𝗿𝗲𝗴𝗶𝘀𝘁𝗲𝗿𝗲𝗱 𝗱𝗼𝗺𝗮𝗶𝗻𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗳𝗼𝗿 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁

Newly registered domains can of course be legitimate. Every domain is new at some point. But usually there isn’t any content on new domains right away – the content is still being developed, and the launch of the site won’t happen for some time.

But newly registered domains are often a tool for phishing attacks. Such domains are usually used in phishing attacks immediately after registration and usually disappear again after a short time, for example because they are cancelled or blocked by the registrar.

Blocking access to newly registered domains is a relatively popular and effective way of eliminating phishing.

It is possible to block newly registered and parked domains within Microsoft Defender for Endpoint. Domains within the first 30 days of registration are considered newly registered.

📺 Watch my YouTube video bellow 👇 👇
https://youtu.be/oYtDHK90P1M

#cswrld #videotutorial #mde #defender #phishing #newdomains

𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐄𝐧𝐝𝐩𝐨𝐢𝐧𝐭 𝐓𝐚𝐦𝐩𝐞𝐫 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐞𝐱𝐩𝐥𝐚𝐢𝐧𝐞𝐝

Tamper Protection in Microsoft Defender for Endpoint is protection that protects selected settings, such as virus and malware protection. With tamper protection, you cannot disable selected components of Microsoft Defender for Endpoint or change their settings.

In fact, disabling or changing settings on a security product is usually what a threat actor is trying to do. If they were able to deactivate the protection, it would make their subsequent work much easier. This is why it is extremely important to keep tamper protection active.

📺 Watch my YouTube video bellow on Microsoft Defender for Endpoint protection 👇 👇
https://youtu.be/xnC6Ufl025I

#cswrld #mde #videotutorial #defender #tamperprotection

𝐇𝐎𝐖 𝐓𝐎 𝐓𝐔𝐑𝐍 𝐎𝐍 𝐑𝐄𝐏𝐎𝐑𝐓 𝐌𝐎𝐃𝐄 𝐈𝐍 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓 𝐖𝐄𝐁 𝐂𝐎𝐍𝐓𝐄𝐍𝐓 𝐅𝐈𝐋𝐓𝐄𝐑𝐈𝐍𝐆

Web Content Filtering in Microsoft Defender for Endpoint allows you to filter content based on categories. There are a number of predefined categories to choose from. But first, you need to turn on report mode in Microsoft Defender for Endpoint.

📺 Watch my YouTube video bellow 👇 👇
https://youtu.be/lg3VhjS564k

#cybersecurityworld #cswrld #mde #defender #wcf #contentfiltering #report

𝐇𝐎𝐖 𝐂𝐎𝐍𝐅𝐈𝐆𝐔𝐑𝐄 𝐆𝐑𝐀𝐃𝐔𝐀𝐋 𝐑𝐎𝐋𝐋𝐎𝐔𝐓 𝐏𝐑𝐎𝐂𝐄𝐒𝐒 𝐅𝐎𝐑 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓

Microsoft Defender for Endpoint supports gradual rollout of all update types – Security Intelligence Updates, Engine Updates, and also Platform Updates.

📺 Watch my YouTube video on how to configure gradual rollout process for the updates 👇 👇
https://youtu.be/DJ6k7BucK7Q

#cswrld #videotutorial #mde #defender #rollout #updates #microsoft

𝐇𝐎𝐖 𝐓𝐎 𝐃𝐄𝐏𝐋𝐎𝐘 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐃𝐄𝐅𝐄𝐍𝐃𝐄𝐑 𝐅𝐎𝐑 𝐄𝐍𝐃𝐏𝐎𝐈𝐍𝐓 𝐎𝐍 𝐈𝐎𝐒 𝐕𝐈𝐀 𝐌𝐈𝐂𝐑𝐎𝐒𝐎𝐅𝐓 𝐈𝐍𝐓𝐔𝐍𝐄

Unlike Android, Microsoft Defender for Endpoint can be installed and configured on Apple iOS in a completely zero-touch mode for the end user via Microsoft Intune. The end user does not need to confirm any settings, permissions or anything else on their iOS/iPadOS device afterwards.

📺 Watch my YouTube video bellow for more details 👇 👇
https://youtu.be/QHJCDr49RhY

#cswrld #intune #videotutorial #mde #defender #ios

#KQL query that looks for network connections to these domains via #MDE DeviceNetworkEvents (Connection or DNS Query).

https://github.com/SecurityAura/DE-TH-Aura/blob/main/Defender%20for%20Endpoint/ExternalData%20-%20Network%20Connection%20to%20Tycoon2FA%20Domain.md

Huge thanks to @racwatchin8872 for making the data available in a way that can be accessed via externaldata 🙏

Nice blog post providing insight on using #zeek capabilities in #MDE : https://falconforce.nl/detection-engineering-rabbit-holes-parsing-asn-1-packets-in-kql/ #DFIR #blueteam #KQL

Oggi #20gennaio è #BlueMonday, il giorno più #triste dell'anno.
Un articolo #OpenAccess di #Mde ci racconta come nasce un tipo di #blu, "Blu di Prussia", il primo #pigmento sintetico della storia, dalla sua scoperta all'impiego del suo componente, l'acido prussico o #cianuro, come #veleno nella camere a gas dei #lager nazisti.

⬇️ https://riviste.unimi.it/index.php/MdE/article/view/20675/?mtm_campaign=mastodon