3 ms·
Defender, under certain licenses, is an EDR - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-w
by TecoAndJix 4y ago
Defender, under certain licenses, is an EDR - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
- deleted 4y ago[deleted]
- mesebrec 4y agoWhat is an EDR?
- libraryatnight 4y agoendpoint detection and response: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
- deleted 4y ago[deleted]
- _8j50 4y agoWell they call a LOT of things Defender now anything from email and azure specific alerting to EDR and DLP. It's all "Windows Defender ______". But I meant the consumer license AV. But also even with the most basic win10, cloud submission (if privacy is no biggie) gets you EDR detections to a point but without the edr console and logs. When I simulate attacks with defender on, I would spend a lot of time bypassing it but then as soon as I break opsec (e.g.: run whoami.exe) if cloud submission is on I basically burn that technique because the edr in their cloud blacklisted it but with that off I can last as long as I want so long as I don't execute things flagged as malware by the defender on the host (and even then, usually that thing gets blocked not my original technique which I can still reuse).