Perform Device Investigations (part 2)

By Ashwin Venugopal -

 




To read part 1 please click here


Behavioral Blocking

Today's threat landscape is full of fileless malware that lives off the land, highly polymorphic threats that mutates faster than the traditional solutions can keep up with, as well as human-operated attacks that adapt to what the adversaries find on compromised devices and the traditional solutions are not sufficient to stop such attacks.

Behavioral blocking and containment capabilities can help you to identify and stop the threats based on their behaviors and process trees even when the threat has already started. The next-generation protection, EDR, and the Defender for Endpoint components and features works together with behavioral blocking and containment capabilities.  

It works with the multiple components and features of Defender for Endpoint to stop attacks immediately as well as prevent the attacks from progressing.

  • Next-generation protection (which includes Microsoft Defender Antivirus) can easily detect threats by analyzing behaviors and stop the threats that have already started running.

  • Endpoint Detection and Response (EDR) receives security signals across your network, devices, and kernel behavior. multiple alerts of the same types are aggregated into the incidents, which makes it easier for your security operations team for investigate and respond.

  • Defender for Endpoint has a wide range of optics across identities, email, data, and apps, as well as the network, endpoint, and kernel behavior signals received through the EDR. A component of Microsoft 365 Defender, Defender for Endpoint processes and correlates these signals, raises detection alerts, and connects related alerts in the incidents.    

All these capabilities, helps you to prevent or block more threats, even if they start running and whenever a suspicious behavior is detected, the threat is contained, alerts are created, as well as the threats are stopped in their tracks. 

Client behavioral blocking

Client behavioral blocking is a component of the behavioral blocking and containment capabilities in the Defender for Endpoint and as soon as the suspicious behaviors are detected on devices, artifacts are blocked, checked, and remediated automatically.

How client behavioral blocking works?

Microsoft Defender Antivirus can easily detect suspicious behavior, malicious code, fileless and in-memory attacks, and more on the devices after which they are sent to the cloud protection service. As soon as an artifact is found malicious, it's blocked on the device. 

Client behavioral blocking is effective because it not only helps to prevent an attack from starting, but it can also help stop an attack that has begun executing and with the feedback-loop blocking, attacks are prevented on the other devices in your organization. 

Feedback-loop blocking

Feedback-loop blocking, also known as rapid protection, is a component of behavioral blocking as well as containment capabilities in the Microsoft Defender for Endpoint and with the feedback-loop blocking, devices across your organization are better protected from attacks.

How feedback-loop blocking works?

Whenever a suspicious behavior or file is detected, like by the Microsoft Defender Antivirus, information about that artifact is sent to the multiple classifiers and the rapid protection loop engine inspects as well as correlates the information with the other signals to arrive at a decision as to whether to block a file. Checking and classifying the artifacts happens quickly which results in the rapid blocking of the confirmed malware as well as drives protection across the entire ecosystem.

As the rapid protection is in place, an attack can be stopped on a device, other devices in the organization, and the devices in the other organizations, as an attack attempts to broaden its foothold. 

Endpoint Detection and Response in block mode

When EDR in block mode is turned on, Defender for Endpoint blocks malicious artifacts or behaviors that are observed through post-breach protection. It works behind the scenes to remediate malicious artifacts that are detected post-breach.

It is also integrated with the threat and vulnerability management. Your organization's security team will get a security recommendation to turn EDR in block mode on if it isn't already enabled.

What happens if something is detected?

Whenever EDR in block mode is turned on and a malicious artifact is detected, blocking and remediation actions are taken. You will see the detection status as Blocked or prevented as completed actions in the Action Center. 

    


To read part 1 please click here













Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more