🧰 Microsoft Defender for Endpoint

The items that name it 16

• Tracking AI adoption in North Korean threat actor tradecraft
  articleas tools2026-10-29It is written here as Microsoft Defender for Endpoint (EDR in block mode, network protection, automated investigation and remediation).

  EDR in block mode, network protection, automated investigation and remediation

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas tools2026-10-23It is written here as Microsoft Defender for Endpoint: endpoint protection and alerting for developer workstations, build agents and AI gateway servers.
• Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
  writeupas tools2026-10-13It is written here as Microsoft Defender for Endpoint (alerted on suspicious screen capture via PowerShell; provided process telemetry).

  alerted on suspicious screen capture via PowerShell; provided process telemetry

• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas tools2026-09-30

  Real-time protection, behavior monitoring, and endpoint detection and response (EDR) telemetry on Linux servers; quarantined malicious payloads, surfaced suspicious behaviors (permission changes, background execution, memfd_create, reverse shells), and preserved evidence for investigation.

• Phishing Abuses RMM Tools for Persistent Access
  writeupas tools2026-09-29

  Detects suspicious and uncommon remote-management activity; provides attack surface reduction rules and functionality to block specific signed applications via block certificate action.

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas tools2026-09-29

  EDR in block mode, automated investigation and remediation, attack surface reduction rules, network protection

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas tools2026-09-28

  EDR/antivirus providing detection, EDR in block mode, and network protection against NeedyMantis

• Attack Surface Explained: Types & Reduction Tips
  articleas affected products2026-09-21

  attack surface reduction (ASR) capabilities are a named control set aimed at risky or unnecessary behavior on devices and networks; ASR rules listed as Windows only

• ThreatIntel-Aggregator
  repoas tools2026-09-17

  Target for custom detection rules distinct from Sentinel analytics rules

• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas tools2026-09-09

  Endpoint telemetry source; activity may be absent if the phishing link is opened on an unonboarded personal mobile device.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas tools2026-08-26

  Endpoint protection recommended to detect droppers, miners, second-stage payloads, and anomalous behavior on Linux hosts

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeupas tools2026-06-28

  Logs and notifies users when passwords are saved in Notepad, WordPad, or Office apps (Notify Unsafe App setting).

• Inside Microsoft Defender's Signature World
  writeupas affected products2026-05-22

  Cloud-based endpoint security solution combining sensor capabilities with cloud processing; distinguished from MDA but mentioned as a related Microsoft product.

• n8n Cybersecurity Workflows
  repoas tools2026-05-06

  EDR event ingestion

• ESXi Exploitation in the Wild
  writeupas tools2026-01-07It is written here as Microsoft Defender for Endpoint (MDE).

  Huntress-managed EDR that prevented the TA's Impacket password change attempt

• Today I Learned - Device Discovery
  writeupas affected products2024-04-27It is written here as Microsoft Defender for Endpoint (Windows).

  Windows