RGB software is unfortunately based on unsupported and disavowed software.

Yes, the XKCD cartoon is referenced.

#rgb #software #MicrosoftDefender #CVE

https://youtu.be/H_O5JtBqODA

Microsoft Defender Enhances Cybersecurity with Automated IP Containment for Undiscovered Endpoints

In a bold move to fortify network security, Microsoft is rolling out a new feature in Defender for Endpoint that isolates undiscovered devices, effectively blocking potential lateral movement by cyber...

https://news.lavx.hu/article/microsoft-defender-enhances-cybersecurity-with-automated-ip-containment-for-undiscovered-endpoints

Microsoft Defender will really just flag arbitrary files as malicious with zero evidence, it's just like "trust me bro that's malware I promise, you should delete it". Second biggest waste of money right after Microsoft Support.
#microsoft #microsoftdefender

Frage in die Runde:
Hat jemand von euch (oder kennt jemanden) in den letzten Jahren eine Endpoint Protection oder ein EDR in der Firma eingeführt (z.B. Jamf Protect, Microsoft Defender for Business o.ä.)?

Wie lange hat das ca. gedauert (inkl. datenschutzrechtlichen und IT-Sicherheitsabklärungen)?

Wäre um ein paar Erfahrungswerte aus der Schweiz und dem EU-Raum dankbar

I noticed today that a lot of people are struggling with antivirus alerts, specifically Microsoft Defender:

1) try to understand the alarm itself and at which point in the attack this would happen: phishing email = early, credential access (especially admin credentials) or suspicious C2 IPs = middle, ransomware/data upload = late.

2) what should be the attackers previous and next step then? (just look at 1 again: early/middle/late)

3) can you see this previous/next step in the logs? Look especially for evidence of execution. Attackers want to "do" something. Executables, scripts, PowerShell, command line, services, scheduled tasks?

If you cannot see any previous or any next steps, ask yourself if you're blind (are your logs empty? Timeframe not available?) or if there really aren't any. If there aren't any, it's likely a false positive. If there are, escalate.

Happy hunting!

I select 103 emails to submit to Microsoft for review, they are all falsely classified as phishing and spam.

The submit check box is greyed out, a tooltip says to direct select 100 or less emails to submit.
I deselect 3 emails and try again, the check box is still greyed out, but now there's no tooltip. Broken trash costs a fortune.
#microsoft #microsoft365 #microsoftdefender

I'm using #Unattended to keep my #Ubuntu #server up to date. Today I noticed that the #microsoftdefender agent was not being updated. To include it, edit the file /etc/apt/apt.conf.d/50unattended-upgrades and add the following inside the brackets Unattended-Upgrade::Allowed-Origins:

"microsoft-ubuntu-${distro_codename}-prod ${distro_codename}:${distro_codename}";

The line is distribution codename agnostic.

Best Antivirus Software for Small Businesses in 2024 – Source: www.techrepublic.com https://ciso2ciso.com/best-antivirus-software-for-small-businesses-in-2024-source-www-techrepublic-com/ #rssfeedpostgeneratorecho #SecurityonTechRepublic #SecurityTechRepublic #antivirussoftware #CyberSecurityNews #MicrosoftDefender #CloudSecurity #smallbusiness #GravityZone #TopProducts #TrendMicro #Security #Norton #avira #eset