I'm comparing Microsoft Defender for Endpoint with CrowdStrike's Indicators of Attack. Defender has custom detections, but I can't find a way to immediately block a behavior based on conditions such as: the process is python.exe, the command line contains C:Users, and the command line ends in .py. Are custom detections only intended to alert and respond after execution, or is there another Defender feature that can enforce this kind of rule at execution time?
3 Answers
Advanced Hunting and custom detection rules are probably the closest match. You can write a KQL query and trigger actions when it finds a match, but that is generally detection and response after the event—not an inline prevention rule that stops Python from starting.
Defender for Endpoint’s detection engine and Windows application-control features solve different problems. ASR can block certain predefined behaviors, but it doesn’t let you freely define a condition combining the executable, path, and command-line suffix like this. WDAC or AppLocker are the usual enforcement options, although they may not express this exact rule in the way you need.
We already use both WDAC and AppLocker, but neither gives us the contextual command-line rule described above.
You’re not overlooking a hidden custom-detection setting. A custom detection normally evaluates telemetry and then performs a response action, so it isn’t the same as an inline execution block. In this case, the functional gap is real: CrowdStrike may provide that behavior-based prevention in one product workflow, while Microsoft splits detection, ASR, and application control across separate features. The practical test is to run the exact command and compare when execution stops versus when the alert appears—if the alert comes after the process runs, you have detection rather than prevention.
That’s the limitation I’m running into. The rule can detect the activity, but it doesn’t prevent the process from executing in the first place.