Defender For Endpoint

Microsoft Defender for Endpoint Internals 0x05 — Telemetry for sensitive actions

Microsoft Defender for Endpoint Internals 0x04 — Timeline telemetry

FalconFriday — Detecting ADCS web services abuse — 0xFF20

FalconFriday — Detecting LSASS dumping with debug privileges — 0xFF1F

Credential dumping from Local…

Microsoft Defender for Endpoint Internals 0x03 — MDE telemetry unreliability and log augmentation

FalconFriday — Suspicious named pipe events — 0xFF1B

Sysmon vs Microsoft Defender for Endpoint, MDE Internals 0x01

FalconFriday — Detecting UAC Bypasses — 0xFF16

Attackers often require full administrative privileges on a machine to be able…

FalconFriday — DLL hijacking & suspicious unsigned files 0xFF06