Sysmon vs Microsoft Defender for Endpoint, MDE Internals 0x01

Reducing your Office 365 attack surface — Part 1: Hardening a vanilla Office 365

Microsoft Defender for Endpoint Internals 0x02 — Audit Settings and Telemetry

Sysmon 11 — DNS improvements and FileDelete events

Sysmon 13 — Process tampering detection

Symon 13 adds a new detective capability to your detection…

FalconFriday — Suspicious named pipe events — 0xFF1B

Graphing MITRE ATT&CK via Bloodhound

I’ve been using slides like the image below for some time now in presentations and I regularly…

Microsoft Defender for Endpoint Internals 0x04 — Timeline telemetry

Debugging the undebuggable and finding a CVE in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint Internals 0x03 — MDE telemetry unreliability and log augmentation