custom detections

Can Defender for Endpoint block custom process behavior like CrowdStrike IOAs?

I'm trying to determine whether Defender for Endpoint has an equivalent to CrowdStrike's Indicators of Attack that can block a specific behavior immediately, rather than only detect it…

Does Defender for Endpoint support custom inline behavior blocking?

I'm comparing Microsoft Defender for Endpoint with CrowdStrike's Indicators of Attack. Defender has custom detections, but I can't find a way to immediately block a behavior based on…

Do you build custom detections with Microsoft Defender for Endpoint?

I was reading about a recent PaperCut exploit where suspicious activity was identified through commands such as whoami and local administrator-group enumeration. I tested several unusual commands in…