#microsoft365defender — Public Fediverse posts

𝐌𝐚𝐧𝐚𝐠𝐞 𝐲𝐨𝐮𝐫 𝐝𝐞𝐯𝐢𝐜𝐞𝐬 𝐰𝐢𝐭𝐡 𝐞𝐚𝐬𝐞 𝐮𝐬𝐢𝐧𝐠 𝐝𝐲𝐧𝐚𝐦𝐢𝐜 𝐫𝐮𝐥𝐞𝐬 𝐟𝐨𝐫 𝐝𝐞𝐯𝐢𝐜𝐞 𝐭𝐚𝐠𝐠𝐢𝐧𝐠 𝐢𝐧 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫

We are excited to announce that dynamic rules for tagging devices is now generally available. This feature enables security teams to create and manage rules that automatically assign and remove tags from devices based on user-defined criteria directly in the Microsoft Defender portal.

Dynamic tags:

- simplify tag management,

- reduce manual efforts,

- facilitate efficient device tracking,

- simplify compliance by automatically categorizing non-compliant devices

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/manage-your-devices-with-ease-using-dynamic-rules-for-device/ba-p/4024988

#edr #xdr #defender #defenderxdr #microsoft365defender #endpoint #management #tag #device #compliance #microsoft #microsoftsecurity #soc #cloudsecurity #cloud #cloudnative

𝗥𝗲𝘀𝗽𝗼𝗻𝗱 𝘁𝗼 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝘁𝗲𝗻𝗮𝗻𝘁𝘀 𝗺𝗼𝗿𝗲 𝗲𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲𝗹𝘆 𝘄𝗶𝘁𝗵 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗺𝘂𝗹𝘁𝗶-𝘁𝗲𝗻𝗮𝗻𝘁 𝘀𝘂𝗽𝗽𝗼𝗿𝘁

Today we are excited to expand our current public preview for multi-tenant environments in Microsoft 365 Defender, which provides large organizations with the much-needed visibility and ease of use across their distributed environments.

This addition marks the first wave of improvements, with a focus on global SOC investigation flows, including a consolidated view of incidents across tenants, device inventory, vulnerability management, the ability to perform advanced hunting across data in multiple tenants, and more

https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/respond-to-threats-across-tenants-more-effectively-with/ba-p/3901174

#microsoft #microsoft365defender #multitenant #soc #xdr #edr #azure #coudsecurity #managedserviceprovider #threat #threathunting

Adversary-in-The-Middle & Business Email Compromisedthreat hunting with KQL

Find out essential points for threat hunting, focusing on how to track "potential" AiTM/BEC activities using Kusto Query Language (KQL) in Microsoft 365 Defender

https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/aitm-amp-bec-threat-hunting-with-kql/ba-p/3885166

#bec #AiTM #hunting #m365defender #microsoft365defender #threathunting #microsoft #azure #soc #phishing #kql #kusto #cloudsecurity

𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐈𝐝𝐞𝐧𝐭𝐢𝐭𝐲 𝐞𝐱𝐩𝐚𝐧𝐝𝐬 𝐢𝐭𝐬 𝐜𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐧𝐞𝐰 𝐀𝐃 𝐂𝐒 𝐬𝐞𝐧𝐬𝐨𝐫

Sensor that can be deployed on Active Directory Certificate Services (AD CS) servers. This new sensor builds on the existing detections for suspicious certificate usage available today and extends Defender for Identities capabilities and coverage more comprehensively across identity environments.

AD CS is a role in Windows Server that allows you to create and manage public key infrastructure (PKI) certificates.

New detections:

➡️Domain-controller certificate issuance for a non-DC

➡️Suspicious disable of audit logs of AD CS

➡️Suspicious deletion of the certificate database

➡️Suspicious modifications to the AD CS settings (coming soon)

https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/microsoft-defender-for-identity-expands-its-coverage-with-new-ad/ba-p/3894215

#defenderforidentity #xdr #mdi #azure #microsoft #micrsoftsecurity #soc #adcs #pki #windows #server #cybersecurity #microsoft365defender #cloudsecurity #identity

Microsoft Defender for Office 365 has been recognized as a leader in The Forrester Wave ™: Enterprise Email Security, Q2 2023 report.

For more information on this recognition, check out the full report here: https://reprints2.forrester.com/#/assets/2/108/RES178496/report

https://www.microsoft.com/en-us/security/blog/2023/06/12/forrester-names-microsoft-a-leader-in-the-2023-enterprise-email-security-wave/

#microsoft #office365 #security #leader #email #xdr #defender #microsoft365defender #mdo #emailprotection #emailsecurity #phishing #spam #SecOps #soc #analyst #bec #sandboxing #emailauthentication #collaboration #siem #ir #threatintelligence #azure #cloud #cloudsecurity #cloudnative

Automatically disrupt adversary-in-the-middle (AiTM) attacks with Microsoft XDR

Microsoft announced expansion of automatic attack disruption to include adversary-in-the-middle attacks (AiTM) attacks, in an addition to the previously announced public preview for business email compromise (BEC) and human-operated ransomware attacks.

https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/automatically-disrupt-adversary-in-the-middle-aitm-attacks-with/ba-p/3821751

#microsoft #email #business #AiTM #bec #xdr #azure #soc #securityplatform #defender #defenderforidentity #defenderforcloudapps #defenderforendpoint #microsoft365defender #cloudsecurity #securityanalytst

Automatically disrupt adversary-in-the-middle (AiTM) attacks with Microsoft XDR

Microsoft announced expansion of automatic attack disruption to include adversary-in-the-middle attacks (AiTM) attacks, in an addition to the previously announced public preview for business email compromise (BEC) and human-operated ransomware attacks.

https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/automatically-disrupt-adversary-in-the-middle-aitm-attacks-with/ba-p/3821751

#microsoft #email #business #AiTM #bec #xdr #azure #soc #securityplatform #defender #defenderforidentity #defenderforcloudapps #defenderforendpoint #microsoft365defender #cloudsecurity #securityanalytst

Microsoft Defender Threat Intelligence (Defender TI) is now available to licensed customers within the Microsoft 365 Defender (M365 Defender) portal, placing its powerful threat intelligence side-by-side with the advanced XDR functionality of M365 Defender.

Use Cases

➡ Advanced hunting with Defender TI IOCs against the logs and Events within Microsoft 365 Defender

➡Upload IOC to a storage account\public GitHub

➡Using KQL Externaldata operator as correlation source and proactive hunting and enabling custom detection on M365 Defender

➡M365 Defender Raw Event Detection

➡M365D Raw events flow into Sentinel with the M365 Defender Data connector

➡MDTI Feeds flow into Sentinel with MDTI Data connector

➡Manual TI correlation rule

https://techcommunity.microsoft.com/t5/microsoft-defender-threat/what-s-new-mdti-interoperability-with-microsoft-365-defender/ba-p/3799846

#DefenderTI #TI #threatintelligence #MicrosoftDefenderThreatIntelligence #xdr #soc #securityplatform #securityanalytst #m365defender #microsoft365defender #microsoft #azure #intelligence #ioc #threathunting #ttp

Microsoft Defender Threat Intelligence (Defender TI) is now available to licensed customers within the Microsoft 365 Defender (M365 Defender) portal, placing its powerful threat intelligence side-by-side with the advanced XDR functionality of M365 Defender.

Use Cases

➡ Advanced hunting with Defender TI IOCs against the logs and Events within Microsoft 365 Defender

➡Upload IOC to a storage account\public GitHub

➡Using KQL Externaldata operator as correlation source and proactive hunting and enabling custom detection on M365 Defender

➡M365 Defender Raw Event Detection

➡M365D Raw events flow into Sentinel with the M365 Defender Data connector

➡MDTI Feeds flow into Sentinel with MDTI Data connector

➡Manual TI correlation rule

https://techcommunity.microsoft.com/t5/microsoft-defender-threat/what-s-new-mdti-interoperability-with-microsoft-365-defender/ba-p/3799846

#DefenderTI #TI #threatintelligence #MicrosoftDefenderThreatIntelligence #xdr #soc #securityplatform #securityanalytst #m365defender #microsoft365defender #microsoft #azure #intelligence #ioc #threathunting #ttp

📢 Find out new Microsoft Entra Features:

➡Identity security / protecting Identities

🔸 Azure AD Recommendations

🔸 More information on why a sign-in was flagged “unfamiliar”

➡Identity modernization

🔸Converged Authentication Methods

🔸Granular device management using custom roles

🔸Azure AD Single-Sign-On enhancements

🔸Attribute Name format for SAML claims

🔸Apply RegEx Replace to the group claim content

🔸Multiple instances of the same application (IDP- and SP-initiated)

🔸 Persistent NameID for IDP-initiated apps

🔸AD FS migration advisor in Microsoft 365 admin center

➡Identity Governance

🔸New SCIM connector for ServiceNow

🔸Provisioning insights workbook

🔸 Expanding Privileged Identity Management (PIM) role activation across the Azure portal

➡Identity for multicloud

🔸Workload Identity Federation for Managed Identities

➡Passwordless

🔸Multiple Passwordless Phone Sign-in for iOS devices

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/new-microsoft-entra-features-now-available/ba-p/2967447

#microsoft #azure #security #entra #azuread #azureactivedirectory #aad #epm #identity #pim #multicloud #passwordless #ios #saml #servicenow #sso #singlesignon #cloudidentity #governance #identitygovernance #iam #iag #microsoft365 #microsoft365defender

📢 Find out new Microsoft Entra Features:

➡Identity security / protecting Identities

🔸 Azure AD Recommendations

🔸 More information on why a sign-in was flagged “unfamiliar”

➡Identity modernization

🔸Converged Authentication Methods

🔸Granular device management using custom roles

🔸Azure AD Single-Sign-On enhancements

🔸Attribute Name format for SAML claims

🔸Apply RegEx Replace to the group claim content

🔸Multiple instances of the same application (IDP- and SP-initiated)

🔸 Persistent NameID for IDP-initiated apps

🔸AD FS migration advisor in Microsoft 365 admin center

➡Identity Governance

🔸New SCIM connector for ServiceNow

🔸Provisioning insights workbook

🔸 Expanding Privileged Identity Management (PIM) role activation across the Azure portal

➡Identity for multicloud

🔸Workload Identity Federation for Managed Identities

➡Passwordless

🔸Multiple Passwordless Phone Sign-in for iOS devices

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/new-microsoft-entra-features-now-available/ba-p/2967447

#microsoft #azure #security #entra #azuread #azureactivedirectory #aad #epm #identity #pim #multicloud #passwordless #ios #saml #servicenow #sso #singlesignon #cloudidentity #governance #identitygovernance #iam #iag #microsoft365 #microsoft365defender

Discovering internet-facing devices using Microsoft Defender for Endpoint

MDE is expanding device discovery capabilities through our existing network telemetry and RiskIQ integration.

Find out how to discover your internet-facing devices through Microsoft 365 Defender portal and Advanced Hunting.

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/discovering-internet-facing-devices-using-microsoft-defender-for/ba-p/3778975

#mde #edr #xdr #discovery #easm #riskiq #microsoftsecurity #microsoft365defender #advancedhunting #hunting #kql #soc #securityplatform #secops #network #discovery #microsoft #cloudsecurity

Adversary-in-the-middle (AiTM) phishing is capable of circumventing multifactor authentication (MFA) through reverse-proxy functionality.

Dig into an example of a real-life attack and explore how to mitigate these types of attacks.

https://www.microsoft.com/en-us/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/

#AiTM #mfa #2fa #multifactorauthentication #azure #azuread #azureactivedirectory #defender #xdr #microsoft365defender #microsoft #microsoftsecurity #microsoft365 #conditionalaccess #antiphishing #sentinel #microsoftsentinel #identity #identityprotection #reverseproxy #cybersecurity #iam #iag #ueba #credentialtheft #phishing #soc #securityanalyst #monitoring #risk

Microsoft Defender for Office 365 named Best Email Security Service of 2023 by SE Labs

https://www.microsoft.com/en-us/security/blog/2023/02/21/microsoft-defender-for-office-365-named-best-email-security-service-of-2023-by-se-labs/

#MicrosoftDefenderforOffice365 #Microsoft365Defender #Cybersecurity #Emailsecurity

Microsoft Defender for Endpoint on Linux devices can now be manually isolated from the network through the Microsoft 365 Defender portal or using APIs, helping to prevent attackers from controlling compromised devices. API Linux isolation is also available and the device can be reconnected to the network at any time. https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-device-isolation-support-for-linux/ba-p/3676400 #Microsoft365Defender #MicrosoftDefender #LinuxIsolation

Zerobot is a Go-based botnet that spreads primarily through IoT and web application vulnerabilities.

Learn how Zerobot works and how to defend devices and networks against it:

- Use Microsoft 365 Defender as security solutions with cross-domain visibility and detection capabilities

- Adopt a comprehensive IoT security solution such as Microsoft Defender for IoT, integrate it with XDR platform such as Microsoft Sentinel and Microsoft 365 Defender

- Harden endpoints with a comprehensive Windows security solution

- Ensure secure configurations for devices

- Use least privileges access

https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/

#microsoft #windows #security #iot #MSTIC #azure #xdr #microsoft365defender #defenderforIoT #iot #sentinel #microsoftsentinel #siem #soar #cloud #cloudsecurity #Zerobot #ssh #leastprivilege #rat #ioc #threatintelligence #ti #tip #ddos #ZeroStresser #webapp #vulnerabilities #cve