Can Defender for Endpoint block custom process behavior like CrowdStrike IOAs?
I'm trying to determine whether Defender for Endpoint has an equivalent to CrowdStrike's Indicators of Attack that can block a specific behavior immediately, rather than only detect it…