Vulnerability on Anything About IT

How To Detect the Log4Shell Vulnerability (CVE-2021-44228) with Microsoft Endpoint Configuration Manager

Tue, 14 Dec 2021 21:25:13 +0000

Hello there,

These days everyone is trying to identify devices that are vulnerable to the Log4Shell Vulnerability (CVE-2021-44228). If your only systems management tool is Microsoft Endpoint Configuration Manager this blog is for you.

You can of course create device collections based on installed programs, however log4j-core.jar files can be found in several locations in and outside the Program files folder. So in order to identify these files, we have to search for them on the entire disk. Here’s the script I prepared for that.

Use Microsoft Endpoint Configuration Manager to stop the Windows Print Spooler Service

Sat, 03 Jul 2021 13:23:55 +0000

Hello there,

I guess by now, everyone has heard of the Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-34527). At this time Microsoft recommends disabling the Print Spooler service on domain controllers and on servers where it is not needed or to Disable inbound remote printing through Group Policy. In this short blog post I will demonstrate how you can use Microsoft Endpoint Configuration Manager to identify systems where the print spooler service is running and how to stop and disable the service.

How to generate a monthly Defender ATP Threat and Vulnerability Report

Sun, 10 Nov 2019 23:00:53 +0000

Update 11 January 2020 - Microsoft has updated the Advanced Hunting Schema, so ComputerName is now DeviceName in the queries.

Just recently Microsoft announced that the Defender ATP advanced hunting schema was extended with the following tables:

DeviceTvmSoftwareInventoryVulnerabilities
DeviceTvmSoftwareVulnerabilitiesKB
DeviceTvmSecureConfigurationAssessment
DeviceTvmSecureConfigurationAssessmentKB

This allows us to run advanced hunting queries to find and extract Defender ATP TVM data.

https://gist.github.com/alexverboon/d22727c0c8f0d8ca32953b5e2c79ba7f

Now the people in your organization who are responsible for threat and vulnerability management might not necessarily have the knowledge of using the advanced hunting query language or are provided access to the Defender ATP console. So why not just send them a monthly report? Following is how to create a monthly Defender ATP TVM report using advanced hunting and Microsoft Flow.