I responded to multiple major compromises during the Hafnium Exchange hacks. https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium-hack-exchange-server-

I responded to multiple major compromises during the Hafnium Exchange hacks. https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium-hack-exchange-server-email-flaw-white-house https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium... In quite a few cases, we identified that ultimately a server has been popped using this unknown zero day, but never before seen webshells and Cobalt strike droppers all ended up dropped on servers and then deleted by Windows Defender. We recommended rebuilds regardless but the product clearly provided more security than people give it credit for. Then we identified a number of places it didn't appear to work. Why? The answer was people following "best practices" of adding AV exclusions for the whole web root folder, and for some reason the whole user profile folder. That big Kaseya hack? Every Kaseya user was told by Kaseya to add exclusions for every folder used by the product. One of the understated issues with modern EDR products is people simply following vendor advise and making it useless. I've got a software product that handles payment details that randomly drops EICAR test files in random folders all of the user PC while it's running just so it can shut itself down if it detects Defender in use "for support reasons". All the top EDR products in the world and all the hardening advice you can find can go down the toilet pretty quickly if you let vendors tell you how to run these products - ignoring them is a highly rated hardening tip.