It was my pleasure to introduce peer groups to Third Tier. In 2024, we’re introducing focused learning groups for Defender, Intune, Public speaking and more
Endpoint Manager
17 posts
Despite criminal masterminds and “security researchers” always coming up with the next greatest tool for causing financial damage to our businesses and economy, there are patterns.
Defense implies a reactionary approach. Prevention set the scene where ransomware can’t get you in the first place.
It’s one of the least known and used portal in the entire Microsoft 365 suite. Too bad, because it contains some configuration and automation gems. Let’s see how we use it to automate Office updates.
Fortunately, Defender protects against this when configured correctly. In addition to the Defender for Endpoint sensor installation, Attack Surface Reduction rules and certain anti-virus configurations should also be deployed
Once these two items have been set the ability of PlugX to take advantage of innocent people should be thwarted.
All it took was an email attachment policy, a little hardening of Microsoft Office and the configuration of the built-in anti-virus software
It’s an Attack Surface Reduction rule and it is exploited in the wild, so it’s import to close up this vulnerability to fileless attacks.
Where should you configure ASR rules? I had this question, so I asked a contact in Endpoint Management at Microsoft.
Turning off Autoplay is a recommended policy in Endpoint Manager device configuration. It is recommended because it can prevent the automatic opening a files from any drive type