3 ms·
It's been reported that Windows Defender can detect and report on malicious certificates: https://twitter.com/AmitaiTechie/status/1217156973268893696 https://t
by technion 7y ago
It's been reported that Windows Defender can detect and report on malicious certificates:
https://twitter.com/AmitaiTechie/status/1217156973268893696 https://twitter.com/AmitaiTechie/status/1217156973268893696
Of course, that relies on not having Defender disabled by an alternate product.
- taspeotis 7y agoOn Windows Server 2016 and newer it stays enabled even with an “alternate product.” https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016 https://docs.microsoft.com/en-us/windows/security/threat-pro... > In Windows Server 2016, Windows Defender AV will not disable itself if you are running another antivirus product.
- technion 7y agoTrue, but imagine you deployed SEP in accordance with supplier's instructions: https://support.symantec.com/us/en/article.tech237177.html https://support.symantec.com/us/en/article.tech237177.html Or Mcafee: https://kc.mcafee.com/corporate/index?page=content&id=KB82450 https://kc.mcafee.com/corporate/index?page=content&id=KB8245... (search for DisableRealtimeMonitoring) For a deeper dive: I ran into issues on a security assessment trying to run procdump on lsass being blocked by Defender. Workaround.. was to find a machine with McAfee installed where that behavior was allowed.