#Modern Workplace

  It was a cold gloomy day when I set out on a mission to fix an issue involving ASR rules. Something which I may have done a dozen of times so I said to myself, why it should be any different this time. But if history has taught me anything, it is that no two issues are the same, despite how much they resemble and that for every issue there is a possible solution. You just have to stay relentless and you will eventually make it to the other side. The issue.. It all began with the ASR rules in 'block mode' starting to block macros on a set of devices. Pretty routine at this stage as the logical thing to do is either to configure necessary exclusions or put the relevant ASR rule in a non restrictive state like 'Audit' mode. The problem is that no matter what changes I made to the ASR rules, they simply didn't make any difference. Macros continued to be blocked and the events in Advanced hunting would confirm the same. When I checked the registry on the devices in que...

Consider a scenario where an organization has different teams for managing security of devices across the board using Defender portal and another team for managing endpoints using MEM admin portal. When you have Intune integrated with Microsoft Defender for Endpoint, the security team can request remediation from MEM team in form of a ticket, which will then open a security task for action in the MEM admin portal. The activity of the same can then be monitored in MDE portal by the security team. This integration allows synergy across different teams in an organization by leveraging vulnerability management capabilities within Defender for Endpoint. After you connect Intune to Microsoft Defender for Endpoint, Defender for Endpoint receives threat and vulnerability details from managed devices. There are obviously some pre-requisites involved that you need to take care of - 1. Configure a service-to-service connection with Microsoft Defender for Endpoint. 2. Deploy a device configuration...

There are multiple ways of configuring Microsoft Defender SmartScreen settings in Intune. You can use the Device configuration, custom CSPs, Endpoint Security or even custom Powershell scripts. Microsoft recommends using Endpoint Security to configure device security policies on your endpoints. This is because the policies are specially focused around device security thus keeping the settings relevant. However, not all security settings are covered under Endpoint Security and this became evident while configuring SmartScreen. In order to configure SmartScreen , you enable the settings under  Endpoint Security-> Web Protection as shown below. While this does enable the SmartScreen, it does not configure all the way as users are allowed to disable the option if they like (That is the last thing you want). Also, there is no setting to enable SmartScreen for IE if you are using Endpoint Security profiles. To get around this, you will need to deploy some additional settings using D...

Continuing from my previous post on ' Controlled Folder Access - Ransomware Protection, Exclusions, Trusted apps and much more..' , I wanted to cover another application behavior involving Defender policies. The application in question is Bloomberg Excel addin which is widely used across the industry. Formally known as Bloomberg API (Applications Program Interface), is a powerful tool that allows you to deliver Bloomberg data into MS Excel spreadsheet for analysis and calculations. In the absence of exclusions and with the all relevant Defender policies switched on, users would see similar errors as shown below. As always, the best way to understand which all Defender policies are causing this, is to run the Advanced Hunting query to gather details on the device events. There are multiple ways in which a query can be formed, but since I want to know which policies are in question here, I am using a slightly generic query to get details on all possible ActionTypes causing the bl...

Microsoft Defender for Endpoint Device Control protects against data loss by monitoring and controlling media use of removable storage devices and USB drives. It is part of the Attack Surface Reduction profiles which enables auditing, read, write or execute access to removable storage. Once you enable Device Control policy, you can find the device control report in the Microsoft 365 security center . However, please note that the device control report can have a 12-hour delay from the time a media connection occurs to the time the event is reflected in the card or in the domain list. I recently came across a situation where there was a requirement for allowing the use of USB screen sharing solutions like Barco Clickshare . They are normally used in VC Meeting rooms and the process for activation requires plugging them into a laptop and running the application executable. To ensure the use of such devices, you either disable the Device Control policy or simply create a whitelist. C...

Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It does so by checking apps against a list of trusted apps. This is particularly important during Ransomware attacks when user data can get encrypted which is normally found in common system folders. Here is a list of Windows system folders that are protected by default: c:\Users\<username>\Documents c:\Users\Public\Documents c:\Users\<username>\Pictures c:\Users\Public\Pictures c:\Users\Public\Videos c:\Users\<username>\Videos c:\Users\<username>\Music c:\Users\Public\Music c:\Users\<username>\Favorites The protected folders also include boot sectors and you can add more folders, allow specific apps access to the protected folders or exclude them all together. I recently dealt with one such application that needed to be allowed access to the protected folders. The app in question is Symantec Encryption Desktop. The first ind...