#Modern Workplace

Indicator of compromise (IoCs) is an essential feature in every endpoint protection solution. This capability gives SecOps the ability to set a list of indicators for detection and for blocking. Back in August'21, I had published a blog on ' Creating custom Network Indicator rules in Defender for Endpoint '. As part of the MDE configuration series, I wanted to cover the creation of IoC for mobile devices as well. Now for IoC to work, devices need to be onboarded on MDE and it is no different for mobile devices. You can head over to my posts from February'22 to check out the onboarding process for both iOS and Android mobile devices. One thing to note here is that as of writing this blog, only IPs & URLs\domains under IoC are supported for mobile devices at this point. When creating a new indicator (IoC), one or more of the following actions are available: Allow – the IoC will be allowed to run on your devices. Audit – an alert will be triggered when the IoC runs. ...

Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It does so by checking apps against a list of trusted apps. This is particularly important during Ransomware attacks when user data can get encrypted which is normally found in common system folders. Here is a list of Windows system folders that are protected by default: c:\Users\<username>\Documents c:\Users\Public\Documents c:\Users\<username>\Pictures c:\Users\Public\Pictures c:\Users\Public\Videos c:\Users\<username>\Videos c:\Users\<username>\Music c:\Users\Public\Music c:\Users\<username>\Favorites The protected folders also include boot sectors and you can add more folders, allow specific apps access to the protected folders or exclude them all together. I recently dealt with one such application that needed to be allowed access to the protected folders. The app in question is Symantec Encryption Desktop. The first ind...

Picking up from my last post that covers details on enabling & creating Web Content Filtering rule in Defender for Endpoint, I will now cover the process for creating custom network indicator rules that can be used to supersede the Web Content Filtering categories. What are Indicators anyway? Defender for Endpoint can block malicious IPs/URLs through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser based on Microsoft's own threat intelligence data. By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your organization's own threat intelligence. What are the pre-requisites for Indicators? Before one can go about setting up the rules, following pre-requisites must be met. 1. Network Protection to be enabled in block mode. 2. The Antimalware client version must be 4.18.1906.x or later. 3. Supported on machines on Windows 10,...