Welcome to another episode of the Everyday Defender
podcast. Super excited to be recording again.
My name is Chris Goosen and I am joined as always
by my friend from the Netherlands, Koos. Hey,
Chris. Good morning. How are you doing? Doing
well. Hey, it's been a month since we last saw
each other. Can you imagine? Can you believe
that it's been a month? Crazy. That's really
crazy. That's really crazy. It feels like last
week or something like that. Yeah. man it really
does hey um i'm still trying to get my sleep
back back on track which is wild right that i've
been i've been home now for you know i don't
know three four weeks and i'm still trying to
get my sleep back on track after that trip that
trip completely messed up my my sleeping patterns
um which is a very strict procedure when it comes
to getting my sleep back on track so i try to
sleep a little bit on the plane back to europe
and then i really want to stay awake that first
day so i actually planned a birthday party of
a friend of mine and we went to that party so
i'm i was sure i wasn't going to sit on a couch
and fall asleep during the day to keep up all
the way until the night and then keep stick to
my regular schedule immediately and it seems
to work for me Yeah, fair enough. Yeah, I actually,
I got home on a Monday morning and I worked on
that day. So I went straight from the airport
at 6am to, well, I didn't go to the office, but
I came here and logged on to work. So I did try
and stay awake all day too, but man, it hasn't
helped. Anyway, in today's episode, one big topic,
I guess, right? We're looking at Defender XDR,
the attack disruption feature. And I know this
is something that you've been really sort of
digging into and you're quite excited about.
So I figured, you know, let's have a conversation
about this and sort of tell the good folks what
this is all about and how it's matured and developed,
right? Because it's not a brand new thing. It's
been around for a little while, hasn't it? That's
true. I think this is one of the most exciting
features, part of Defender XDR. So I think it
deserves its own podcast episode, to be honest.
Yeah, you're right. Attack Disruption is around.
It released somewhere in 2023. I don't know the
exact month, to be honest. So it's already here
for, let's say, two years. But obviously, Microsoft
is adding new and new features and new capabilities
and scenarios to it. And I really saw some really
impressive demos last couple of months, and I
wrote some blogs about it. So that's why I thought,
well, We should put some effort in this and share
it with the world because I think this is a prime
example of how all the different defenders, so
to speak, can work together in a great way. So
what it actually does, it attacks disruption
like the name suggests. It is meant to disrupt
an attack while it is taking place. So normally
your security product, a regular EDR or antivirus
would... work something like we saw certain events
here's the evidence please investigate it and
respond to this and microsoft wants to move away
from this more and more and they want to provide
actual protection and stop the attackers in their
threats when they're active and that's what attack
disruption is all about yeah and i i can see
i can see why um you know you mentioned um how
all the defenders work together right and i can
see you know i've been saying for a while that
we're in this world now where we have you know
we used to have um this mentality of like best
of breed where organizations wanted to go out
and buy the best product in each sort of domain
right you bought the best av from that vendor
you bought the best other tool from that vendor
um but i think we're we're in this world of like
best of platform now where you've got to be able
to look at a vendor that has a platform that
that supports all of these things and and so
i'm you know i can see when you say all the defenders
working together i can kind of see where this
might be going as far as we've got signals from
you know an endpoint product we've got signals
from other um defender products all kind of working
to to disrupt something that that might be going
on in the environment Yeah, and that's also a
bit good that you touch on this. It's also a
part of the confusion sometimes because Microsoft
talks about Defender XDR as if it is a single
product you can buy. but it's actually the encompassing
platform containing all the different security
products you have to buy separately or buy E5
and you'll get all of them, but you have to set
them up individually. And that's also what I
wanted to touch on on today's episode. It is
enabled by default, but it is best practice to
make sure that everything's set up properly according
to best practices to work most optimally. Yeah,
so like you said, it combines a lot of the signals
from all of the different Defender products.
Well, not all of them right now, but again, Microsoft
is expanding on that every time. When you read
into this, you always come across a lot of the
marketing mumbo -jumbo, I would say. But some
of these terms Microsoft uses, I really like.
So I wanted to, with a little bit of a nod, I
did put them in the show notes. So Microsoft
talks about... When they do things in real time,
they're talking about at machine speed. I find
that a very interesting wording. And they want
to stress that they only apply attack disruption
when they're very confident. So high confidence
signals, of course, because you want to prevent
further damage. But on a false positive, you
might include damage without an attack, right?
So I think that's important. so it works through
some some separate separate stages so you have
the detection part again where you correlate
all the different uh signals and in a high confidence
incident then they want to correlate those uh
signals because for example something the fan
of identity saw on the identity part and something
that the fan of our endpoint saw on an endpoint
might not always be uh uh correlated together
right the the not might not be the same attack
so they need to correlate that and then they
use something they call intent recognition. So
they have all kinds of scenarios predefined.
They don't tell much about what kind of scenarios
are supported for obvious reasons, but they have.
apparently done a lot of research in this to
identify certain, well, familiar attacks they
saw on different organizations or in their own
environments. And also they're using the organization's
attack paths. So we talked about this a little
bit earlier. Defender XDR can show you attack
paths. So your vulnerable machines or... how
everything's linked together in a graph, so to
speak. And they actually use that information
to see, okay, when something happens on this
part of the graph and then the next link is touched,
it might be an attack happening because those
two are linked together. Yeah, and then actually
the attack disruption takes place and it tries
to identify compromised assets. So for example,
users, devices, mailbox, apps. So this already
gives away a little bit of what products are
used in the back to determine what Microsoft
calls the blast radius. And it's also a great
marketing term. I really like when they use it.
You don't want it to happen, but when people
talk about blast radius, I'm thinking about explosions
and bank heists and whatnot. So once they determine
the blast radius, they know what compromised
assets are part of the attack, and then they
can in real time block these, contain these,
and prohibit further actions. um yeah and obviously
microsoft will tell you that it is ai powered
because everything is ai powered nowadays right
that's right that's right i can imagine they
use a lot of machine learning algorithms to to
uh detect certain patterns uh but everything
machine learning is nowadays called ai i guess
so well fair enough but you know i think what's
interesting here is so you know during the sort
of detection phase here they they stress and
when you read the microsoft documentation on
this as well high confidence is is continuously
stressed right and i imagine that that's because
they are looking at multiple things that are
happening in multiple places and being able to
like you said correlate them together to say
okay well we know for sure that if we see this
thing happening on the endpoint and this thing
happening on the identity um and this perhaps
this other um thing happening we know that those
things go together in a particular type of attack
um and and that's how they know for sure right
the height the high confidence and i if i remember
correctly from from some documentation i read
they they actually have a number that they put
to it right for high confidence like 90 99 .5
or something like that um yeah they say 99 percent
uh so they they will also tell you less than
one percent of false positives so they are right
above 99 but they don't specify any uh A decimal
number there. But indeed, they want to stress
that only when they're very confident, then they
go into action. And they actually use all of
the telemetry in your environment. So when you're
still in control, so when Microsoft decides to
perform actions as part of the tech disruption.
The incidents and alerts are also in your incident
page, right? And they will tag that incident
attack disruption to let the SOC analyst know
that Microsoft was involved in some of the response
as part of the incident. But you are still in
control and Microsoft will. will pay attention
to the telemetry data following up an attack
disruption action to see how the SOC responds.
So if attack disruption, for example, disables
a user and the SOC immediately re -enables the
user again, that might be useful information
to Microsoft to learn for next attacks to even
improve that number to a higher one. Now, for
someone who hasn't... been across this or come
across this before this might sound really scary
because you're thinking in your mind right now
the environment is just doing its thing it's
just doing stuff without me knowing right and
i guess that's kind of fair in that they are
stepping in and they are taking disrupting attacks
right before you can but these these um the scenarios
where attack disruption occurs they are very
very sort of stiff right there are very specific
scenarios that microsoft have worked on where
they've over time they've they've they've uh
i guess identified these specific scenarios whether
we know they're high risk but they've also been
able to identify all of the related signals and
actions and stuff you know events and incidents
that happen and so they know when they see all
of these things it makes up for example uh you
know a business email compromise attack and and
they know then how to get it right um what are
those What are those? There are a few of them.
It's like three or four of them. This BEC is
one of them. What are the other ones? Yeah, human
-operated ransomware is one of the examples.
And there were a couple of scenarios, adversary
in the middle, of course, password spray attacks.
But again, they don't disclose every single scenario.
These are just examples they put in the documentation,
just to stress that they are basing them. upon
some hypotheses they created up in advance, but
they will not disclose all of the details because
then you might know how to work around them.
But yes, it is a valid point. So based on these
scenarios, they try to do the correlation. And
again, even if you are that 1 % or less than
1 % scenario and a tech disruption did contain
a device or user or whatever, there might be
impact but i think the trade -off is if it was
a real attack the impact would have been much
larger than just an inconvenience for for a couple
of users right yeah yeah that's fair that's fair
enough and but but but uh i i know uh the larger
the the organization is the more uh stressful
they get about these kinds of topics so um when
i saw the fan of endpoints being enrolled in
in larger corporates i know they didn't like
the uh automation part of it to start with to
to contain certain processes for example so when
you run a malicious powershell script to do some
process injection in a different executable uh
defender endpoints might act on that by killing
those processes for example um and again if there's
a false positive there your application might
crash or something like that um and and larger
companies want to disable those features and
they see the more small smaller companies really
liking these features because, well, first of
all, they don't have the capacity on the security
department to actually look into all of these
individual signals 24 seven. And also Microsoft
has a lot of nice examples. And I actually put
a couple of them in the show notes on our website
where they have a business email compromise and
an adversary in the middle attack in one kill
chain. A real world example where you see that
after five hours after the initial breach, the
SOC was able to respond. And with attack disruption,
a couple of steps earlier, much time was won.
during the same attack. So you can't be as quick,
I guess, as attack disruption in this regard.
Yeah, fair enough. So what are the things? So
when we talk about disrupting the attack, right,
this is where, you know. Defender actually steps
in and says, hey, this device doesn't look good.
We're going to contain this device in some way,
or this user account seems to be compromised.
We're going to disable the user account. That's
the things that we're talking about when we talk
about actual actions that are being performed.
Yeah, that's true. So there are actually now
a couple of respond actions currently supported.
And again, I can imagine Microsoft will expand
on this in the future. But right now, they can
do something like a device contain, which is
a device isolation in the FANFA endpoint. Something
relatively new is the user contain, which is
different than a disable user. So Microsoft FANFA
XDR could decide to disable a user using Entry
ID. And... defender identity to disable the use
of both in the cloud and on the on -premises
environment at the same time which also prevents
a lag in sync time right so they disable them
immediately on both ends but they also support
something they call a contain user and this is
something that can be done on the endpoints so
i'm actually referring to a blog post of a former
colleague of mine jeffrey he's from the netherlands
and he writes a lot about defender endpoints
and he figured figured out a way to simulate
attack disruption so this is really useful and
interesting to try out in your lab environment
and he has it all documented in his blog post
how you can can reenact this this attack and
what's interesting is that the Defender for Endpoint,
separately from Defender for Identity, are acting
to different degrees. So containing a user on
the endpoint actually means that a certain user
is not allowed anymore to connect to that machine,
while the account might still be active. And
this is done to prevent lateral movement, for
example. So when Microsoft suspects a user account
being used for lateral movement, but is not 100
% sure right to disable the user, go ahead to
disable the user. It might deploy a policy across
all of the managed Defender for Endpoint clients
to make sure that that user cannot do an RDP
connection any longer, for example. And it's
actually leveraged a group policy on the local
machine to achieve this. Okay, wow. So it actually
reaches in and does that sort of config during...
Okay, that's pretty cool. Yeah, and that's why
they call it contain user, contrary to disable
user, so that the user is contained in a single
place. And they also recently added third -party
support with SAP. So this is the first third
-party response action. So when you configure
SAP through Microsoft Sentinel correctly, they
can, for example, contain a compromised asset
by locking suspicious SAP users when they detect
a financial process manipulation or something
like that. And again, I can imagine more actions
will follow in the future. Now, I can imagine
there'll be folks who think about this and go,
okay, well, this is great for my regular user
environment where I have information workers
and frontline workers perhaps, but there may
be certain user accounts or certain things that
I want to avoid or exclude from this process.
We have the capability to do that, don't we?
Yeah, so that's why it's important to also make
sure that you follow some configuration steps.
And Microsoft did detail these in their documentation.
And that's something I wanted to touch on on
today's episode as well. So again, attack disruption
is enabled by default, but it relies on certain
components being set up. And one of the things
you can do indeed is exclude certain device groups,
for example, so that you exclude entire. uh devices
in in of a certain category in your environment
and you can also exclude users in in the fan
of identity in this case but again you have to
be careful right there's a trade -off there because
if you would say well my domain controllers they
are very important i want to exclude them for
any of these actions well this might also be
the place where people try to attack and steal
your credentials right so microsoft does not
advise you to exclude anything So that is best
practice, but there will surely be environments
who think differently of this. Yeah, that's fair.
I think everyone has some uniqueness in their
environment, right, where you've got to be able
to address it. So it's nice to have the feature,
but I think very important warning, as you said,
right, is don't sort of be tempted to just go
and find the... the most important things in
your environment and exclude them because those
most important things are also going to be the
you know the richest target for for the bad bad
folks Yeah, and I saw a session from Eyal. He's
a PM from Israel on attack disruption. And he
actually mentioned that although the false positive
rate is less than 1%, customers are actually
asking him if attack disruption can be even a
little bit more aggressive. So customers are
apparently letting them know, some of them at
least, that they would accept a few more false
positives as a trade -off that attack disruption.
does more in practice in reality. That's interesting.
Yeah, that is interesting. Yeah, so according
to Microsoft, they are currently disrupting 40
,000 incidents a month. And that's also a crazy
number, I guess. Well, yeah. I mean, it's crazy
to think that there's that many things that are
being... There's that many environments that
have this deployed and where this is actually
making a difference. Can you imagine how many
environments there are? overall where this isn't
deployed and they don't have that telemetry right
so it just shows you the scary sort of state
of the of the internet in general and and man
it's it's all over the place isn't it yeah and
companies might not yet be aware of the fact
that the tech disruption did anything in their
environment just yet so i would also invite people
to look in their current environment going to
the advanced hunting page in the security .microsoft
.com portal and run a hunting query I put in
the show notes where you can see if there are
any incidents with the label attack disruption
on there in the past. So again, there might have
been certain steps already taken for you without
you noticing it. So back to the configuration
part. So Defender for Endpoint, again, like I
said, it relies on a couple of things. And one
of the things is also the device discovery. So
as you might know, Chris, Defender for Endpoint
is able to discover devices in the same network,
which might not be onboarded with Defender for
Endpoint. And this is a really important factor
for tech disruption to work. So for example,
when a unmanaged device in the network network
is compromised and something somebody tries to
move laterally from an unmanaged device into
a managed device it is important to understand
that well it's important to know that Defender
needs to be aware of that unmanaged device in
the first place to detect that lateral movement.
And that's why you need to go into the settings
and enable device discovery and put it on the
standard mode. And some companies might have
switched it to a lower setting, basic in this
case. Well, I would advise everybody to put it
back into standards. And it already gives you
very valuable information of what devices you
might have missed during the onboarding, right?
Yeah, okay. Very good. I always see companies
struggling with maintaining a 100 % compliance
rate across all of their devices. And I think
device discovery is a great example. And there's
also a hunting query I put in the show notes,
which you can run to list all of the discovered
devices, including the last seen timestamp and
by which other. device, that unmanaged device
was seen. So it helps you pinpoint also what
party or an environment and which network. the
device was seen. And this is also to work against,
let's say, malicious devices being plugged into
a network, right? So if somebody goes into as
a printer mechanic, for example, we've all seen
the examples and plugs in a Raspberry Pi or whatnot
in some of the outlets, that device will be discovered
by other endpoints if this is enabled. Okay.
Another thing that's important is that you have
to run the latest tense agent. So this is the
actual agent running on the endpoint from the
fan of endpoints. And I also included a hunting
query in the show notes, which you can run to.
get a list of all the endpoints which might still
have an older sense agent so that you know that
you need to take a closer look at this. It might
be good practice to create a detection or a dashboard
with this query to keep an eye on this to make
sure everything's up to date. Sometimes these
automatic updates fail for some reason, and it's
good to make sure that everything's up to date,
right? Yeah, yeah. Yeah, these KQL queries that
you've included in the show notes are going to
be really, really useful for folks. So folks,
you know, definitely make sure you pay attention
to the show notes. We've mentioned it before
on the show as well as a lot of effort goes into
the show notes. And these are very much, you
know, standalone blog posts on their own, really,
if you, you know, so definitely pay attention
there. There's some really helpful nuggets been
supplied there. Thank you. Thanks for the effort
there. Yeah, welcome. Yeah. So sometimes I'm
struggling with the whole concept of a podcast,
right? So I want to share stuff. I want to show
people some screenshots of settings. And now
I'm just able to talk about it. But at least
we have the show notes to put in some evidence
and actually some helpful queries in there. Yeah.
Yeah, we promise we won't be breaking out the
PowerPoints on this show ever. But the show notes
will be there. They're always going to be as
comprehensive as we can make them. Yeah. Yeah,
so next up, something you need to configure is
the Fennifer identity. So again, we mentioned
also the very important part of attack disruption
because your identities, well, a lot of companies
still have their on -premises Active Directory
and users might live there. There might be domain
admin groups you want to monitor closely to make
sure that when new users are added to that, for
example, you get an alert. So Microsoft wants
you to enable the Fennifer identity. part of
attack disruption and you have actually have
two ways of performing actions on the actual
domain controllers and maybe chris you can you
can elaborate a little bit more into this because
Local Active Directory, it's been a while since
I touched that. By default, a sensor is using
the local system account, which might not, well,
it's the default, but Microsoft advises you that
you have the ability to use a, what they call
a GMSA account, a Group Managed Service account,
right, instead. But they stress that if you configure
that and the account does not exist anymore,
then obviously Defender for Identity will no
longer work correctly. Yeah, it's an interesting
one. I think the GMSAs are interesting because
back in the day when we created service accounts
in AD, folks just created a user account, gave
it domain admins, gave it a long password, and
off they went. That was just how it was done.
the group managed service accounts are just a
way to have the Windows operating system manage
those service accounts right for you. And you
don't have to worry about a password that has
to be changed by a user or anything like that.
But honestly, I very rarely see these used correctly.
Really? uh active directory assessments for for
customers um you know more often than not they're
they're not using them or they're only using
them for a very select small amount of of things
so um yeah it'd be interesting it's interesting
i would imagine that in most scenarios the uh
the local system account is probably what is
going to be used here for for the sensor yeah
Yeah, so is the GMSA, is that a cloud of the
on -prem equivalent of a managed identity in
Azure then, I guess, in EntryD? Yes, I guess
that's probably, that is a good way to put it.
Yeah, absolutely. Yeah, so I can imagine on -prem
applications need to support GMSA specifically
to be able to work with them, right? That's right,
yeah. So a lot of third parties don't always
work so well, you know, when you look at third
party things. So, yeah, no, that's a good call
out. Yeah. Yeah, Microsoft also stresses that
you want to make sure that all of your sensors
in MDI, Defender for Identity, are healthy. So
Microsoft Defender for Identity really relies
heavily on auditing policies because they need
all of the audit events from Active Directory
to come in on the domain controllers to be logged,
to be picked up by the agent, to send to the
Defender for Identity platform to be pre -processed.
And as part of the Defender for Identity onboarding,
you go through documentation telling... you exactly
what kind of auditing policies you need to enable
on your domain controllers. But we see some configuration
drift there with customers sometimes for, well,
they touch policies, they rearrange them, they
make changes to them, unassign them, I don't
know what they do. But for some reason, all of
a sudden, your audit policies are not being logged
anymore. And then Defender for Identity gets
an unhealthy sensor. So you can check the status
of these sensors in the portal to make sure that
all of the domain controllers are still configured
as they should. You know, there's a lot that
goes on behind the scenes there, right, with
these sensors, grabbing all of those alerts and
then processing them and sending them up. So,
you know, it's worth making sure that things
are working as they should, you know, and not
just sort of setting them and walking away from
it because it's, yeah, there's a lot going on
behind the scenes. Yeah, I really like this approach
where Microsoft... collect a lot of the logs
or raw logs, so to speak, into their own workspace
or whatever storage they have in the back end
and just provide you the alerts and the incidents
that they correlate out of it. And well, we touched
on Microsoft Sentinel a couple of times, and
this is one of the topics I like to speak about
a lot. And I see companies still. having a desire
to collect all of the raw logs from all domain
controllers and all kinds of network appliances.
And I'm like, okay, so you're trying to recreate
your own Microsoft definitive identity, so to
speak, right? By collecting them and doing your
own detections on them. And I think what Microsoft
does is really, really useful because they have
the power of the numbers, right? They have so
much telemetry and data. It's probably unlikely
that you're able to come up with better detection.
than they do. So, yeah. But that's why they rely
this much on the audit logs. Defender for cloud
apps is also covered. There are a couple of steps
in the show notes. Again, linking to Microsoft
documentation. You have to make sure that the
cloud app, Defender for cloud app is connected
to Microsoft 365 through connector. App governance
should be turned on. And also in Defender for
Office 365, there are a couple of key points
like some auditing requirements again. And also
safe links policy needs to be present. Some details
like that. And again, without setting this up,
attack disruption might still work for endpoint
and identity related. But you want to cover as
much as possible by making sure all of these
products are enabled and configured in a proper
way. Yeah. If you think about it, I mean, the
way to do, for example, the business email compromise
scenario, right? Really, you need to be able
to look at the mailboxes. You need to be able
to look at things that are events that are happening
within the mailbox, which means, you know. exchange
online is a is a pretty big requirement here
and and being able to get to the unified audit
log and all of those types of things yeah so
i can imagine you still come across some customers
with with actual running their own exchange right
maybe on premises or in the clouds yeah look
um i haven't it's been a while since i've i've
had any customers who are running exchange server
in the cloud um it has happened and i've seen
some pretty large deployments of it but um yeah
there still are those folks who are on um exchange
on -prem you know exchange server uh in their
own data center and you know there's um we know
that uh exchange uh what are they calling it
subscription edition is is going to be due out
sometime at the end of the year i think um and
there's not a lot of time for folks who are on
16 and 19 to be getting ready for that upgrade
so um Yeah, we feel for those folks, but very
often their place and where they are now is based
on some technical debt and decisions that they've
made, right? But yeah, for this to work, really,
you need to be online. Exchange Online is where
you want to be if you want to take advantage
of this capability. Yeah, so customers are still
running Exchange 2016. That sounds crazy to me.
They had a couple of years to migrate away from
that, right? yeah that's right and um you know
hey exchange 2013 is still still around as well
there are a lot of customers that are still running
that so i don't want to know i actually heard
from a customer a a couple of weeks ago which
we helped with a completely different project
but they they they finalized migrating away from
lotus notes a couple of months ago so i was like
oh that's still around as well and that's great
yeah yeah i'm sure you know all these things
are there are all these bespoke places all over
all over that are that still have you know many
of these these crazy things i haven't i think
the last time i saw notes myself was 2019 maybe
was probably the last time i saw i saw lotus
notes but hey i'm sure that still exists Yeah,
we all know how it goes, especially with the
larger corporations. They have a lot of history
and a lot of legacy applications for the same
reason. But it's really hard to protect those
environments because they have this stuff running
around like Exchange 2013. I can imagine it's
not safe to have that exposed to the internet
any longer, right? Yeah, no, you wouldn't want
to. Hey, you know, it's difficult, right? Because
I think... i you know i know of organizations
that are still trying to get off 2013 right um
and you know they those types of projects can
take years if they're a very large environment
um but also you know yeah it's it's perhaps that's
a conversation for the for a different episode
right is is the perils of of old software but
uh no i i see what you're saying for sure yeah
Yeah, so lastly, I want to touch on notifications.
So we did touch on customers might be fearsome
of Microsoft interrupting and actually going
to take action on certain response. But you can
enable notifications on these actions. So it
might be a good idea in general to configure
a notification whenever a device is isolated,
for example. so that a certain team gets an email
that that that that is that did happen and it
might be sock analyst doing it manually but it
might also be caused by attack disruption and
now at least you know that somebody deliberately
isolated a device, for example. Same goes with
contain user, disable user. So when you go into
the portal, you can go to settings and you have
a notification option with a pull down menu where
you can actually select which kind of actions
should trigger a notification alert. And then
at least you can, well, maybe sleep a little
bit more easily knowing that the text disruption
is fully enabled. But whenever it does something
that... can really be impactful in your environment.
At least there's also an email going out to certain
teams. And it also makes sure that, for example,
when a tech disruption disables a user and a
SOC analyst is not aware of that and the server
desk, for example, gets a call by somebody not
being able to log in any longer and the server
desk just re -enables the account again and the
attacker can abuse it again, right? So notification
paths, I think, are very useful to consider as
well. yeah because also i mean someone might
not be in the console looking at the the alerts
and stuff at that time right so yeah i can i
can see how that would be super important yeah
especially because these actions uh can be very
impactful right so So in the show notes, I put
some links to a lot of documentation on Microsoft,
some configuration guides, but also, again, a
shout out to my former colleague, Jeffrey Appel.
He writes a lot about Defender for Endpoint.
I think whenever you Google anything on Defender
for Endpoint, I think sometimes he comes up even
higher than Microsoft's documentation. He also
wrote about attack disruption, and if you want
to try out the simulation he wrote. He has written,
he makes use of Mimikots and Impacket, which
are red teaming tools to manipulate certain credentials
and cached credentials. You can go read along
and try it out yourself and see a tech disruption
in action. Yeah, those are super useful resources
there, Kost. I think, Jeffrey's stuff. I've come
across a lot of his stuff in the past. So yeah,
he puts a lot of effort into his post. He writes
old school blog posts with screenshots and all
the rest of it. So it's really, really useful
stuff to read. So very cool. Yeah. And the technical
guys like you and me really like the stuff. I
wonder sometimes how it's possible that Jeffrey
has more than 24 hours in a day because he's
cranking out his blog posts sometimes on a weekly
basis. Yeah. Yeah. Hey, there are a few people
in now. In our community, they're like that,
right? You kind of wonder. I was just thinking
today that, you know, wondering if Meryl Fernandez
ever sleeps because he also seems to be everywhere
all at once. Also a prime example. Yeah, yeah.
That's super useful, the attack disruption stuff.
I think this is really valuable information.
Thanks for kind of running through it here. I
think, you know, really is. if you've got a e5
and you have this capability you know there's
very little for you to do to be able to take
advantage of this and you know chances are it's
probably saved your bacon already right um i
think for for a lot of folks if you if you didn't
know about it but you have all of these capabilities
enabled it may have already been working for
you and you just you know you haven't uh you
haven't realized it so i'm really useful information
to kind of talk through Yeah, and if you do not
have E5 just yet and you're up for renewal on
your existing EDR or antivirus solution. I really
think it's useful to consider moving to Microsoft
Security Stack. So like we mentioned earlier,
if your identities live in Okta and you use CrowdStrike
as EDR and you have a different AV solution and
you have, I don't know, Exchange on -prem, all
of this nice fancy stuff will not work for you
or at least not in the full coverage mode. So
I think Microsoft has a really interesting feature
in this way. all of their tools work together
so i would really uh stress consider switching
uh perhaps even to uh to this because you cannot
achieve this without different products yeah
yeah and i think it goes back to that as i said
in the beginning right sort of best of platform
type uh scenario where it really makes a lot
of sense to have all your eggs in this really
large basket Yeah, I know companies also are
a little bit scared of the idea. Vendor lock
-in is a thing for a couple of years now already.
You had a community project prepared, Chris.
Yes, I was just about to say, moving on to community
project. Honestly, I think this is a very topical
community project because it really does touch
nicely and go nicely with what we've just talked
about, right? there's a microsoft mvp and i think
he's based in the uk uh called mezbauden and
he's put together a powershell script that uh
helps administrators you know identify um and
and respond to security incidents in exchange
online right um you know he refers to it as a
microsoft 365 security incident investigation
tool which is quite a quite a mouthful um but
really it's very much focused on on exchange
online and and what's great about this is It
allows you to quickly investigate, you know,
if you've had an incident in your environment,
you can use the script to look for those sort
of indicators of compromise. Right. So very often
if I've worked with a customer where they've,
you know, they've had a business email compromise.
you know, incident happen and they don't have
to attack disruption, which has disabled the
account for them. You know, generally what happens
is when a bad actor gets into a mailbox, they
do a bunch of things, right? So, you know, one
of those things is almost always they're going
to go create, you know, inbox rules, things that
will remove sent items immediately or auto forward
attachments onto them, things like that to try
and keep their, you know, their foothold and
retain persistence in the environment. Those
types of things, they'll mess around with mailbox
permissions and grant themselves access to things
or what have you. And what his script does, and
I love this because it's a one -stop shop tool
for looking at these types of incidences, is
it uses the Exchange PowerShell module. So it's
doing some stuff with the audit logs in Exchange
Online, and it's using Graph. as well to go and
um you know look for these types of indicators
of compromise so the the six that he's got listed
um that he that he kind of looks for is malicious
inbox rules which we've talked about um you know
unusual email volume if all of a sudden the mailbox
starts spamming email out um things like that
uh permission changes to mailboxes right if you've
got you know ceo mailboxes and stuff like that
and all of a sudden delegates get added to it
that type of thing you know that's potentially
a red flag um you know uh um critical email deletion
detection and then he's got export monitoring
as well right and again if you've got you know
a help desk mailbox or some other you know um
you know heavily uh guarded mailbox that all
of a sudden starts dumping all its mail right
um you know that could potentially be a an indicator
of compromise so i i really like what he's done
here put a lot of stuff together in in sort of
a single um tool that you can kind of you get
from github and and and and run and i think he's
he's made it modular so you can actually you
know run the individual checks separately or
you can run the tool to do things um i would
you know props to him for doing that i think
this goes really well with the discussion we've
just had on on um uh this attack disruption and
just generally attacks And yeah, if you're an
Exchange administrator in Exchange Online, I
would highly suggest you take a look. I've got
a link in the show notes to the GitHub repo for
this. And obviously, yeah, of course, if you
like it or you think there's something missing
or you want to provide feedback, feel free to
get in touch with Mesbah and shoot him a note.
Yeah. yeah thanks for creating this ms bar and
uh it's a little bit like advanced hunting but
then on your exchange audit logs right so we
touched on hunting in the past so it might be
good practice to make this part of your uh hunting
strategy yeah very very cool stuff so wanted
to share that there's also a really large blog
post which i actually haven't linked to but on
the um uh the practical 365 blog he actually
breaks it down in you know really deep detail
but I've got a link to his own blog and his Git
repository here, so you can find him. And yeah,
with that, I think that hopefully brings us to
the end of hopefully a very interesting and fascinating
sort of threat -related show. I hope people found
it informative. Yeah, absolutely. We're always
open to feedback. Please feel free to reach out
to us if there's anything specific you want us
to talk about or to catch up with. Sadly, we
don't have any more in -person events coming
up in the near future, but we'll continue to
do these every month as we have been. We've always
got plenty of things that we want to talk about
and not enough time. Microsoft keeps us busy
with new products and features every week, right?
That's right. So, yes, thanks again for listening.
Please feel free to like, subscribe, shoot us
a note if there's something that's on your mind.
And we look forward to your company on the next
episode. because thank you i know you've got
to kick off your day so really appreciate you
joining me early in the morning and uh yeah i'm
not sure if you noticed but the sun is shining
a little bit brighter this time uh this time
of year so it's actually becoming a little bit
of summer uh over here so finally the dark days
are are over i guess yeah we're getting them
here now it's gonna be it'll be dark probably
20 minutes from now it'll be it'll be fully dark
outside here so we'll trade we'll try places
for the next six months enjoy your evening i'm
going and jump into my car drive to the office
cool see you next time