Hi looking for idea here

We have blocked most of the AI in discovered app ( unsscntionned) but we will need to allow some ai to specific users

In my search the best way is with device group. Sadly I don’t see a good way to do this as with the default filters I could filter them by tag exemple deepseek tag for deepseek ai

But users changes devices sometimes and we would like more to filter them by azure group as as of nous I would have to always manually tag the new devices or etc

Any better way to do this?

Thanks

I'm not seeing any references to the naming convention of TVM. Anyone seen this before?

The vulnerability listed just has one reference to a random GitHub with a Bitlocker Bypass vulnerability. No other information.

We use MDE. For alerting on data exfiltration attempts, I want to collect certain event viewer logs from the windows 11 endpoints and view them in Security portal/SIEM. Is it possible? If yes, how please.

Are you using heavier features like enable file hash computation?

Are you havong lots of exlusions?

Are you using cloud protection?

I saw it taking quite a lot of memory even without scans or blocking enabled -> between 400 and 600 MB, is this normal? Seems a bit high.

We are using MDE device control to block USB access. Exception process is in place, we collect the user id and machine id to ensure that usb is accessible only for a particular user on a specific device.

Now we want to test that when the exception is provided user should only be able to write data to usb if it's encrypted. How should we be approaching this along with a provision for exception for use cases where encrypted USB cant be used on business device e.g. RIG

Hi

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

• All devices the user was logged into
• Suspicious sign-ins
• Mail traffic after the breach
• Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

Hi,

I'm a bit lost here. We have a domain controller VM in Azure. I've enabled Defender for Cloud P2 at the subscription layer. I can see the MDE agent is enabled in extenstions.

When I check the Defender XDR Portal, it tells me the DC isn't enrolled to MDE security settings. This is after a few days too.

We have two on prem DCs that are showing ok but they have the "on prem" Defender licence, not Defender for Cloud.

Also, do we have to configure the actual defender settings via a GPO? The server setup seems very convoluted versus onboarding to Intune.

We are planning to purchase a defender for our organization. Our infrastructure is hosted in AWS and includes both Windows and Linux servers. We have more than 200 employees in the organization, and we need a security monitoring solution that can provide protection and visibility for both endpoints and servers.

We would like to know which XDR tool would be the best fit for our environment. It would also be helpful if you could share approximate pricing or licensing costs based on your experience

Hi,

I’m looking for some help with creating a workbook in Microsoft Sentinel.

I’ve managed to create one where you enter the user email, date, and time range, and when it runs it returns around 6 different results (Google searches, emails, internet history, etc.)

The issue is that the output looks quite messy because it brings back too many results at once. Is there a way to add a selection before running the query (for example checkboxes/options) so I can choose which results I want returned, and only show those?

Any advice would be appreciated.

Thanks!

We’re running KnowBe4 phishing simulations in a Microsoft 365 and Defender environment, and have configured Advanced Delivery Policies as recommended by KnowBe4. The emails are being delivered but we’re still seeing MDE detect and quarantine some simulated attachments, specifically .xlsm files.

Example event: OUTLOOK.EXE created file Invoice.xlsm

Path: C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\<folder>\Invoice.xlsm

Defender finds: TrojanDownloader:O97M/Obfuse.SU!MTB inside Invoice.xlsm->xl/vbaProject.bin

Defender also finds: Trojan:O97M/Phish.RV!MTB inside Invoice.xlsm->xl/drawings/_rels/drawing1.xml.rels

The remediation action is successful quarantine and in some cases the alert says it prevented attempted open by OUTLOOK.EXE.

My understanding is that Advanced Delivery helps Microsoft 365 Defender for Office identify authorised phishing simulations and bypass certain mail filtering and detonation behaviour but it does not necessarily stop Defender MDE from scanning and quarantining the file once Outlook writes it to the cache locally. So this appears to be endpoint protection detecting the simulated payload rather than Microsoft 365 blocking delivery.

Has anyone else run into this with KnowBe4 .xlsm or macro-enabled phishing simulation attachments? This has been ongoing for about 6 months where Microsoft and KB4 are of little help. This is also having a minor impact to our phishing test reports where users that interact with xlsm payload tests are not marked as a fail.

The only option I see to stop these detections would be to whitelist payload behaviour that the phishing tests are there to prevent which feels dumb.

Hi,

I've got some AVD hosts that I want to install Defender on and remove Sophos. It's currently domain joined and GPO managed. It's entra hybrid joined. Its Windows 11 multi session.

I tried with a Dev host, which went well and I could see it in the portal. When I asked our security team to exclude various fslogix items it came to light that I needed to get the AVD registered in intune as that's where the policies for defender live. Upon doing this I started getting all my intune polices and apps, which was sub optimal.

Can I manage exclusions from the defender portal so I don't have to register the other devices in intune?

So I inherited an environment with 0 documentation. I can see the devices are all onboarded into Defender just fine (E5 licenses for all users).

My question is: how? I thought via GPO using an onboarding package but 50 % of our devices are Entra joined and don't get GPO's. There's also no config profile for Defender onboarding in Intune.

Defender is linked with Intune but all of the switches are off (Connect Windows devices version 10.0.15063 and above to Microsoft Defender for Endpoint , this one too).

There is a platform script in Intune using the package, but that's assigned to a test group from a few years ago and definitely does not hit new devices.

HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection shows me that a packageGUID is present so I guess that was the method used, but I cannot for the life of me find out where this is coming from. We don't use any third party MDM, it's all Microsoft.

Any help? I'd like to switch it over to using Intune but I need to disable that legacy shit first.

This would seem like a simple question, but how do the signature updates work with defender. I had assumed that like everyother autvirus/malware product it would deal with updates itself, but when ever I look at available updates there in Azure Update Manager there's a defender update available.

What's the go?

Hello guys, we've recently understood MDE is not tracking Safari traffic. It tracks when the safari process initiates outbound connections to share telemetry etc but not when people manually visit a website. MS support said this is a known issue and the fix will be released in mid July. However, I am not able to find someone that shares the same problem online, which is kinda strange giving the fact this is MDE and Safari... Is anyone else experiencing the same issue or did MS support sent me running a long one?