How can I reliably detect new software installations on Windows endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID. They are not hybrid joined or fully Entra…
advanced hunting
What’s the Most Reliable Way to Detect New Software Installations on Windows Endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID, but they are not hybrid joined or fully…
Do you build custom detections with Microsoft Defender for Endpoint?
I was reading about a recent PaperCut exploit where suspicious activity was identified through commands such as whoami and local administrator-group enumeration. I tested several unusual commands in…
How to Collect Logs from Endpoints Using App Control for Business?
I've set up App Control for Business on a test machine and I'm looking to gather logs centrally for visibility on blocks, policy hits, and other events. Currently,…