Endpoint on Adrenaline Two


Continuing on from my last post that captured using Defender for Cloud to gain powerful additional features on top of defender for endpoint to protect your endpoints we are going to take a closer look at Defender for Endpoint itself and extend into some endpoint-specific use cases for Defender for Identity that tie directly back into Defender for Endpoint.
Firstly a really important consideration when configuring Defender for Endpoint is that alot of the heavy lifting from a prevention standpoint actually happens in Defender Anti virus. This means that while im going to briefly cover some settings to make sure Defender Anti Virus isnt hindering Defender for Endpoint im going to reserve further Defender Anti Virus controls to the next part in this series.
This also of course means that when your doing your own testing just installing the MSSense agent (What you get from the scripts, intune etc) is actually not Defender for Endpoint in its totality so you simply can not make the assertation that the technology did or did not perform in a certain way with the agent alone. That’s even ignoring all the fancy stuff im covering.


As most people using Defender for Endpoint will start at the portal (security.microsoft.com) I’m going to cover what you should configure there first. These features are super simple and as long as you have Office 365 E5 and Defender for Identity you can basically one-click enable them from Settings > Endpoint > Advanced Features.

EDR in block mode

This setting allows the cloud-delivered portion of Defender for Endpoint to send metadata to the Defender Anti Virus antimalware engine to block further detections, technically you dont need this if your using Defender Anti Virus in Active mode (we will be) but it doesnt cost anything to keep on.

Allow or Block file

This allows operators of the portal to identify PE files within a device timeline and block it from executing in the future, once enabled you can also leverage this feature via any given file page.

Custom network indicators

This feature much like the aforementioned one allows operators of the portal to define IP addresses, domains and URLs to block, behind the scenes, SmartScreen does much of the heavy lifting.

Tamper Protection

Enabling this via the portal prevents the configuration of Sense and Defender Anti Virus from being changed in any regard.

If you have the ability to utilize intune for this option, then do so as it grants a so-called "enhanced" tamper protection whereby with the "Configuration/DisableLocalAdminMerge "configuration item enabled, an adversary will be unable to manipulate Defender Antivirus to a much greater degree.

Show user details
This adds further context to data and alert kept in Defender 365 allowing analysts to correlate behaviour to actual humans much more closely.
Office 365 Threat Intelligence connection This setting allows Defender for Endpoint to build kill chains across from a given mailbox to an asset, making it much easier to hunt for further adversary procedures during an active compromise Web Content Filtering This feature mainly uses smart screen and can catch attempts being made to bad domains. Importantly make sure you have ran the following on your assets:
Set-MpPreference -EnableNetworkProtection Enabled

Live Response on Servers

This gives console access to servers we have onboarded into the platform

Live response unsigned script execution

This setting is going to be the coolest in this part of the series as we are going to use to achieve the following:

  • Execute and collect KAPE
  • Deploy Velociraptor
  • Deploy and execute Thor Cloud
  • Retrieve files and submit to Virus Total

Endpoint Settings

As a large portion of Defender for Endpoints ability to protect assets is from Defender Anti Virus and other telemetry it can capture from the operating system there are some mandatory audit settings you need to configure.

Extra Telemetry

Defender for Endpoint requires certain audit policies to be configured to capture as much data as possible. These are captured below

Ensure audit policies are properly configured

Summary: Defender for endpoint utilizes the event log on an asset to enrich its telemetry sources. This means that certain audit policies need to be enabled and enforced so that the proper eventIDs are generated.

While the Sense agent does attempt to set these configuration items it self any audit policy configured will immediately overwrite these settings. Scope: Windows Operating System (any) Actions: Create an group policy with the below configuration and ensure it is enforced across all devices in scope.

Info: The script https://github.com/olafhartong/MDE-AuditCheck can be used to confirm the audit policy is properly implemented.
Enable Real time Protection in Defender Antivirus

Summary: Real time protection allows Defender to actively monitor numerous machine components for threats and take action if something malicious is detected. Real time protection is a core component of Defender for endpoint and must be enabled for it to function properly.

Scope: Windows 7 and Up, Windows Server 2012 R2 and Up


Endpoint Manager: Navigate to Endpoint Manager Security centre > Endpoint Security > Antivirus and create a Defender for Antivirus policy. Configure "Turn on real-time protection" to "Yes".

Group Policy: Open Group Policy Management Console > Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real time Protection. Configure "Turn off real-time protection" to "Disabled"

Warning: Devices that have other anti virus products installed in the past automatically disable real time protection. Extra consideration is needed to ensure it is turned back on.

 Enable Cloud-Delivered Protection

 Summary: Cloud-Delivered Protection enables features such as ASR rules, cloud sample submission and tamper protection enforcement and as such is critical to the deployment of Defender for Endpoint.

Scope: Windows 7 and Up, Windows Server 2012 R2 and Up

Intune: Navigate to Endpoint Manager admin centre > Device Configuration > Profiles > Select a profile type or create a new one > Properties > Configuration settings: Edit > Microsoft Defender Antivirus. Configure "Cloud Delivered Protection" to "Enable" and "Prompt users before sample submission" to "Send all data automatically".
Endpoint Manager: Navigate to Endpoint Manager Security centre > Endpoint Security > Antivirus > select or create a Defender for Antivirus policy > Properties > Configuration Settings > Edit. Configure "Turn on cloud-delivered protection" to "Yes", "Cloud –delivered protection level" to "High" and "Defender Cloud Extended Timeout in Seconds" to "50".

Group Policy: Open Group Policy Management Console > Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > MAPS. Configure "Join Microsoft MAPS" to "Advanced MAPS" and "Send file samples when further analysis is required" to "Enabled" and "Send all samples".

Enable Windows Defender Application Control
Summary: Defender Application Control can be used to enrich telemetry collected by Defender for Endpoint. Defender Application Control has wider uses that are valuable to explore but for the purposes of Defender for Endpoint the policies can remain in audit mode.

Scope: Windows 10 and above, Windows Server 2016 and above

Group Policy: Open Group Policy Management Console > Computer Configuration > Administrative Templates > System > Device Guard. Configure "Deploy Windows Defender Application Control" to "Enabled" and "WDAC policy deployment path" to the UNC path of your policy.

Info: It is recommended that currently used drivers are whitelisted and then a blacklist placed for all other instances, this will protect the organisation for bring your own driver techniques. The following script will enable accurate at-scale deployment https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig

Enable Attack Surface Reduction Rules
Summary: Attack surface reduction rules prevent certain behaviours on devices to narrow the available attacks a malicious actor has. These rules are tracked in Defender for Endpoint and are highly valuable for both preventing attacks and detecting them.

Scope: Windows 10 and Up, Windows Server 2012 R2 and Up


Intune: Navigate to Endpoint Manager admin centre > Device Configuration > Profiles > Select or Create an Endpoint Protection profile > Windows Defender Exploit Guard > Attack Surface Reduction. Configure all available ASR rules to "Audit Mode".

Group Policy: Group Policy Management Console > Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack surface reduction > Configure Attack surface reduction rules.
Enter the Below GUIDs and Values:

Enable Attack Surface Reduction Rules (continued.)

Once the rules on the previous page are implemented you can review the results of the ASR rules in audit mode by going to security.microsoft.com, clicking reports > Attack surface reduction rules. It can take 4+ hours before results start to appear. Once you have reviewed the results you can then go back to the policy at endpoint.microsoft.com and add any exceptions you require.
Once you have implemented and reviewed the ASR rules you can begin setting them to 'Block' mode. It is highly recommended you utilize several testing rings before the deployment of ASR rules in 'Block' mode. Use the diagram below to identify rules that are most likely to generate issues.

Cloud Protection

Enable Automated Investigations

Summary: Automated investigations utilize inspection algorithms to further evaluate detected suspicious activity and then perform remediation actions without the need for a human analyst. Automated Investigations are capable of spanning multiple assets and are valuable feature.
Action: Navigate to Microsoft 365 Defender > Settings > Endpoints > Advanced Features. Enable "Automated Investigations"

Enable Live Response

Summary: Live response enables analysts to perform deeper investigations during incident triage. Often analysts use live response to gather 'point in time' information about artefacts related to an alert. Live response is limited to the following actions:

  • Run basic and advanced commands to do investigative work on a device.
  • Download files such as malware samples and outcomes of PowerShell scripts.
  • Download files in the background.
  • Upload a PowerShell script or executable to the library and run it on a device from a tenant level.
  • Take or undo remediation actions.

Action: Navigate to Microsoft 365 Defender > Settings > Endpoints > Advanced Features. Enable "Live Response", "Live Response for Servers"

Disable Automatically Resolve Alerts

Summary: The Automatically Resolve Alerts option allows automated investigations to close alerts if no threat is found or all malicious artefacts were successfully remediated. While automated investigations are valuable they are not perfect and the results of such investigations should still be reviewed by a human analyst.

Action: Navigate to Microsoft 365 Defender > Settings > Endpoints > Advanced Features. Disable "Automatically Resolve Alerts"

Microsoft Defender for Identity

By enabling this product and configuring a 'Directory Service account documented here https://learn.microsoft.com/en-us/defender-for-identity/manage-action-accounts we can now expand protections to those attacks that span across multiple operating systems, This is important because identifying attacks that span multiple systems requires repeated root cause and initial access to be completed. However, with MDI integrated into Defender for Endpoint we can now detect lateral movement between assets with contextual information provided at the front of the alert.

Configure SAM-R  Required Permissions

Within Group Policy Editor: Navigate to Computer configuration >  Windows settings > Security settings >Local policies > Security options select the policy name 'Network access - Restrict clients allowed to make remote calls to SAM' and add the identity you already established as a discovery account for MDI.


In summary, we have converged all the basis controls you are required to enable in order to maximise protection available to an endpoint, Next we will take a brief look at using MCAS to enforce application control and finally dive into hundreds of use cases for a Microsoft Sentinel integration.


Endpoint on Adrenaline : One

Brilliance in the Basics


Endpoint on Adrenaline 3

Writing detections when stuck with EDR

Investigate Two

Standardized Note Taking Format For Analysts

Securing your estate: The First Step

Attack Simulations for your SOC