3 ms·
So it's not the same windows defender product given to consumers? What additional features does Defender ATP have?
by ghostpepper 6y ago
So it's not the same windows defender product given to consumers? What additional features does Defender ATP have?
- staticassertion 6y agoDefender ATP is closer to an EDR tool, which means it's designed for detection and response teams, not individual users. It'll take more a reporting and contextualizing approach than an av that is typically blocking.
- badrabbit 6y agoIt's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior. A good linux example would be httpd starting netcat that connects to a remote port. Or firefox spawning a bash shell. For windows a simple example would be when an office app starts wscript or powershell and that child process schedules taks, wmi, downloads a payload,etc... Those are simple examples but they track more complex attack scenarios, for cloud hosted solutions like defender atp and crowdstrike they also collect everything that happens on every device of every customer, so if they find new malware or an attacker with a certain TTP on one device, they will deploy rules to catch that for all their customers.