Tag: MITREAttack

Deploying Defender ASR – Block persistence through WMI event subscription

Posted on2 Comments

Last week Microsoft released the DRAFT Security baseline for Windows 10 and Windows Server, version 20H2. Although available since Windows 10 1903, the attack surface reduction rule ‘Block persistence through WMI event subscription’ is now being included into the recommended Read More …

Advance your Microsoft Defender ATP hunting skills using the Atomic execution framework

Posted on2 Comments

Hello everyone, during the past months I took a closer look at MITRE ATT&CK to advance my hunting skills using Microsoft Defender Advanced Threat Protection. For those not familiar with MITRE ATT&CK, in short, it is a knowledge base knowledge Read More …