Defender Endpoint

---
name: defender-endpoint
description: "Expert agent for Microsoft Defender for Endpoint (MDE). Covers onboarding, ASR rules, advanced hunting with KQL, automated investigation, device groups, vulnerability management, and Defender XDR integration. WHEN: \"Defender for Endpoint\", \"MDE\", \"ASR rules\", \"advanced hunting\", \"KQL\", \"Microsoft EDR\", \"AIR\", \"Defender XDR\", \"MDE Plan 2\", \"threat analytics\"."
license: MIT
---

# Microsoft Defender for Endpoint

This skill covers Microsoft Defender for Endpoint (MDE), Microsoft's enterprise EDR platform. It has deep expertise in MDE architecture, onboarding methods, Attack Surface Reduction rules, KQL-based advanced hunting, automated investigation and remediation, and integration with the broader Microsoft Defender XDR suite.

## How to Approach Tasks

When you receive a request:

1. **Determine the plan tier** — MDE Plan 1 (M365 E3) vs. Plan 2 (M365 E5). EDR capabilities (advanced hunting, AIR, threat analytics) require Plan 2. Confirm what the user has before recommending features.

2. **Classify the request type:**
   - **Onboarding / deployment** — Load `references/architecture.md`
   - **ASR rules / hardening** — Load `references/best-practices.md`
   - **KQL advanced hunting** — Load `references/best-practices.md` for query guidance
   - **Incident investigation** — Use the investigation workflow below
   - **AIR / automated remediation** — Load `references/best-practices.md`
   - **Vulnerability management** — Use Defender Vulnerability Management guidance below
   - **Integration (Sentinel, Intune, etc.)** — Load `references/architecture.md`

3. **Identify the management path** — Is the organization using Intune, GPO, SCCM, or local scripts for onboarding? This determines configuration options.

4. **Load context** — Read the relevant reference file.

5. **Provide actionable guidance** — Include specific Microsoft 365 Defender portal navigation, KQL queries, or PowerShell commands where applicable.

## MDE Feature Matrix by Plan

| Feature | Plan 1 (E3) | Plan 2 (E5) |
|---|---|---|
| NGAV (next-gen antivirus) | Yes | Yes |
| ASR (Attack Surface Reduction) rules | Yes | Yes |
| Device control (USB, printer) | Yes | Yes |
| Web content filtering | Yes | Yes |
| Network protection | Yes | Yes |
| Endpoint firewall management | Yes | Yes |
| Tamper protection | Yes | Yes |
| EDR (behavioral detection) | No | Yes |
| Advanced hunting (KQL) | No | Yes |
| Automated investigation & remediation (AIR) | No | Yes |
| Threat analytics | No | Yes |
| Microsoft Threat Experts / Defender Experts | No | Yes |
| Defender Vulnerability Management (basic) | No | Yes |
| Defender Vulnerability Management (add-on) | No | Add-on license |
| Live response | No | Yes |
| Device timeline | No | Yes |

## Onboarding Methods

### Windows Onboarding

**Method 1: Microsoft Intune (recommended for cloud-managed)**
1. Navigate to: Endpoint security > Endpoint detection and response
2. Create onboarding policy
3. Deploy to device groups
4. Sensor data appears in MDE portal within 24-48 hours

**Method 2: Group Policy (on-premises AD)**
```
GPO Path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > MDATP

# Download onboarding package from:
# security.microsoft.com > Settings > Endpoints > Device management > Onboarding

# GPO script deployment
# Copy WindowsDefenderATPOnboardingPackage.zip to SYSVOL
# Extract and reference WindowsDefenderATPOnboardingScript.cmd in GPO startup script
```

**Method 3: SCCM (Configuration Manager)**
```
# In SCCM console:
# Assets and Compliance > Endpoint Protection > Microsoft Defender ATP Policies
# Import the onboarding package from MDE portal
# Deploy to collection
```

**Method 4: Local Script (testing/small deployments)**
```powershell
# Run as administrator
.\WindowsDefenderATPOnboardingScript.cmd

# Verify onboarding
Get-Service -Name "Sense" | Select Status
# Status should be: Running

# Check onboarding status
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" | Select OnboardingState
# OnboardingState = 1 means onboarded
```

### macOS Onboarding

```bash
# Via Intune (preferred) or manual:
# 1. Download onboarding package for macOS from MDE portal
# 2. Deploy com.microsoft.wdav.plist configuration profile
# 3. Install wdav.pkg

sudo installer -pkg wdav.pkg -target /
# Grant Full Disk Access via MDM profile for:
# - com.microsoft.wdav
# - com.microsoft.wdav.epsext

# Verify
mdatp health
mdatp health --field real_time_protection_enabled
```

### Linux Onboarding

```bash
# Add Microsoft repository and install
curl -o microsoft.list https://packages.microsoft.com/config/rhel/8/prod.repo
sudo cp ./microsoft.list /etc/yum.repos.d/microsoft-prod.repo
sudo yum install -y mdatp

# Onboard with package from MDE portal
sudo mdatp onboard --onboarding-script WindowsDefenderATPOnboardingScript_RHEL.py

# Verify
mdatp health
systemctl status mdatp
```

### Server Onboarding

**Windows Server 2019+ / Windows Server 2022:**
- Same process as Windows clients via Intune, GPO, or local script
- Requires MDE for Servers license (Plan 2 or Defender for Servers via Defender for Cloud)

**Windows Server 2012 R2 / 2016 (modern unified agent):**
```powershell
# Install the modern unified agent (not the older MMA-based agent)
# Download md4ws.msi from MDE portal onboarding section
.\md4ws.msi /quiet

# Then run onboarding script
.\WindowsDefenderATPOnboardingScript.cmd
```

**Windows Server 2008 R2 SP1 (legacy, requires MMA):**
- Uses Microsoft Monitoring Agent (MMA) with MDE workspace
- Limited telemetry compared to modern agent
- Upgrade path to Server 2016+ strongly recommended

## Attack Surface Reduction (ASR) Rules

ASR rules are a set of configurable controls targeting common exploitation techniques. Available in Plan 1 and Plan 2.

### ASR Rule Reference

| Rule Name | GUID | Target Technique |
|---|---|---|
| Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | T1566 Phishing |
| Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A | T1566.001 Spearphishing Attachment |
| Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899 | T1566.001 |
| Block Office applications from injecting code into processes | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 | T1055 Process Injection |
| Block JavaScript or VBScript from launching downloaded executable content | D3E037E1-3EB8-44C8-A917-57927947596D | T1059.005/007 |
| Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC | T1027 Obfuscation |
| Block Win32 API calls from Office macros | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B | T1559.001 |
| Block credential stealing from Windows local security authority subsystem | 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 | T1003.001 LSASS dump |
| Block process creations originating from PSExec and WMI commands | D1E49AAC-8F56-4280-B9BA-993A6D77406C | T1047 WMI |
| Block untrusted and unsigned processes that run from USB | B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 | USB execution |
| Block persistence through WMI event subscription | E6DB77E5-3DF2-4CF1-B95A-636979351E5B | T1546.003 WMI persistence |
| Block Adobe Reader from creating child processes | 7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C | Adobe exploitation |
| Block abuse of exploited vulnerable signed drivers | 56A863A9-875E-4185-98A7-B882C64B5CE5 | T1068 |
| Use advanced protection against ransomware | C1DB55AB-C21A-4637-BB3F-A12568109D35 | T1486 ransomware |
| Block Office communication applications from creating child processes | 26190899-1602-49E8-8B27-EB1D0A1CE869 | T1566 Outlook exploitation |
| Block executable files from running unless they meet a prevalence, age, or trusted list criteria | 01443614-CD74-433A-B99E-2ECDC07BFC25 | Low prevalence executables |

### ASR Rule Deployment Modes

Each rule can be in one of three modes:
- **Disabled (0)** — Rule inactive
- **Block (1)** — Enforced; blocked events logged
- **Audit (2)** — Events logged but not blocked; use for testing

### ASR Deployment Strategy

**Phase 1: Audit all rules (2-4 weeks)**
```powershell
# Set all rules to Audit mode via PowerShell
# OR via Intune: Endpoint security > Attack surface reduction > Create policy
$RuleGuids = @(
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550",
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A",
    # ... all rule GUIDs
)
$RuleGuids | ForEach-Object {
    Set-MpPreference -AttackSurfaceReductionRules_Ids $_ -AttackSurfaceReductionRules_Actions AuditMode
}
```

**Phase 2: Review audit logs (use KQL)**
```kql
// Find ASR audit events
DeviceEvents
| where ActionType startswith "AsrOfficePolicies" or ActionType startswith "AsrLsass"
| summarize count() by ActionType, FileName, ProcessCommandLine, DeviceName
| order by count_ desc
```

**Phase 3: Create exclusions for legitimate software before enforcement**
```powershell
# Add exclusion for specific process
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\LegitApp\LegitApp.exe"
```

**Phase 4: Move high-confidence rules to Block mode (start with most impactful)**
Priority order for enabling in block mode:
1. Block credential stealing from LSASS (high value, usually low FP)
2. Block executable content from email (high value in email clients)
3. Block Office from creating child processes (high value, may need exclusions)
4. Block obfuscated scripts (medium FP risk, need PS script exclusions)
5. Block process creations from PSExec and WMI (IT tooling may need exclusions)

## KQL Advanced Hunting

Advanced Hunting is the KQL-based threat hunting interface in Microsoft 365 Defender (Plan 2 required). Queries run against 30 days of telemetry.

### Key Tables

| Table | Description |
|---|---|
| `DeviceProcessEvents` | Process creation events |
| `DeviceNetworkEvents` | Network connections |
| `DeviceFileEvents` | File create/modify/delete |
| `DeviceRegistryEvents` | Registry changes |
| `DeviceLogonEvents` | Authentication events |
| `DeviceImageLoadEvents` | DLL/image loads |
| `DeviceEvents` | Misc events (ASR, firewall, etc.) |
| `AlertInfo` | Alert metadata |
| `AlertEvidence` | Evidence attached to alerts |
| `IdentityLogonEvents` | Azure AD / on-prem logon events |
| `EmailEvents` | Email messages (requires Defender for Office) |

### Essential KQL Hunting Queries

**Suspicious PowerShell execution:**
```kql
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "-nop", "bypass", "hidden")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
```

**Office application spawning suspicious child processes:**
```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe",
                       "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

**LSASS credential dumping:**
```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "lsass.exe" or ProcessCommandLine has "lsass"
| where InitiatingProcessFileName !in~ ("services.exe", "wininit.exe", "svchost.exe")
| union (
    DeviceEvents
    | where ActionType == "LsassProcessAccess"
    | where InitiatingProcessFileName !in~ ("MsMpEng.exe", "csrss.exe", "werfault.exe", "taskmgr.exe")
)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

**Lateral movement via SMB/Admin shares:**
```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType == "ConnectionSuccess"
| summarize TargetCount = dcount(RemoteIP), Targets = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, AccountName
| where TargetCount > 3
| order by TargetCount desc
```

**Ransomware behavioral indicators:**
```kql
// Mass file extension changes (encryption)
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileRenamed"
| where PreviousFileName !endswith NewFileName
| summarize FileCount = count(), SampleOldExtensions = make_set(tolower(extract(@"\.(\w+)$", 1, PreviousFileName)), 5)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 5m)
| where FileCount > 50
| order by FileCount desc

// Volume Shadow Copy deletion
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```

**Persistence mechanisms:**
```kql
// Registry Run key modifications
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (
    @"Software\Microsoft\Windows\CurrentVersion\Run",
    @"Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| order by Timestamp desc

// Scheduled task creation
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc
```

### Custom Detection Rules

Custom detection rules run KQL queries on a schedule and generate alerts:

```kql
// Example: Custom detection for certutil download
// Navigate to: Hunting > Custom detections > Create detection rule
// Query:
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-urlcache", "-split", "http", "https")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ReportId, DeviceId
```

**Custom detection rule configuration:**
- **Run frequency**: Every hour (minimum) to every 24 hours
- **Actions**: Alert, isolate device, quarantine file, run antivirus scan
- **MITRE ATT&CK mapping**: Map to relevant technique for alert enrichment
- **Alert severity**: Informational, Low, Medium, High

## Automated Investigation and Remediation (AIR)

AIR automatically investigates alerts and takes remediation actions without analyst involvement. Plan 2 required.

### AIR Configuration

Navigate to: Settings > Endpoints > Advanced features > Automated Investigation
- **Enable** — Turn on AIR
- **Automation level** — Configure per device group:
  - `No automated response` — Investigate only, no actions
  - `Semi - require approval for core folders` — Auto-remediate low-risk, flag core folder changes
  - `Semi - require approval for non-temp folders` — Auto-remediate temp location detections
  - `Full - remediate threats automatically` — Full automated remediation (recommended for mature orgs)

### AIR Review Workflow

1. Navigate to: Incidents & alerts > Action center
2. Review **Pending** actions requiring approval
3. Review **History** of completed automated actions
4. For each pending action:
   - Review investigation graph (shows entities, relationships, evidence)
   - Approve or reject specific remediation actions
   - Add comment for audit trail

### AIR Remediation Actions

AIR can perform the following automatically (based on automation level):
- File quarantine (move to quarantine vault)
- Process kill
- Service disable
- Registry value delete/restore
- Scheduled task removal
- Network isolation (if configured)
- Antivirus scan initiation

## Device Groups and RBAC

### Device Group Strategy

Device groups control policy application, automation level, and RBAC access:

```
Recommended device group structure:
├── Critical Infrastructure (DCs, PKI, etc.)
│   ├── Automation: Semi - require approval
│   └── MDE policy: Maximum protection
├── Servers - Application
│   ├── Automation: Semi - require approval for core folders
│   └── MDE policy: Server-tuned
├── Workstations - Standard
│   ├── Automation: Full
│   └── MDE policy: Full enforcement
├── Workstations - Privileged Access (admin workstations)
│   ├── Automation: Semi - require approval
│   └── MDE policy: Maximum + ASR all rules enforced
└── Test Group
    ├── Automation: Full
    └── MDE policy: Pilot new settings
```

### RBAC Configuration

Navigate to: Settings > Endpoints > Roles

**Recommended roles:**
| Role | Permissions | Assigned To |
|---|---|---|
| SOC Tier 1 | Alerts read, investigation read | L1 analysts |
| SOC Tier 2 | + Live response read, action review | L2 analysts |
| SOC Tier 3 | + Live response write, isolation, full response | L3 / IR |
| SOC Manager | + Role management, settings read | SOC leads |
| Vulnerability Management | Vulnerability read, remediation manage | VM team |

## Vulnerability Management

Defender Vulnerability Management (DVM) is available with Plan 2 (basic) or as an add-on for extended capabilities.

### Key DVM Features

- **Security score** — Overall posture score (0-100)
- **Weaknesses** — CVE list with affected devices, CVSS score, exploit availability
- **Software inventory** — All software detected across managed endpoints
- **Recommendations** — Prioritized remediation tasks based on risk
- **Remediation** — Ticket-based tracking of remediation work
- **Exception management** — Document accepted risk for non-remediable items

### Vulnerability Hunting with KQL

```kql
// Devices with critical CVEs where exploit is publicly available
DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel == "Critical"
| join kind=inner (
    DeviceTvmSoftwareVulnerabilitiesKB
    | where IsExploitAvailable == "1"
) on CveId
| summarize VulnCount = count(), DeviceCount = dcount(DeviceId), Devices = make_set(DeviceName, 20) by CveId, VulnerabilitySeverityLevel
| order by VulnCount desc

// Devices missing critical OS patches
DeviceTvmSoftwareVulnerabilities
| where SoftwareName == "windows_10" or SoftwareName == "windows_11"
| where VulnerabilitySeverityLevel in ("Critical", "High")
| summarize CriticalVulns = count() by DeviceName
| order by CriticalVulns desc
| top 50 by CriticalVulns
```

## Reference Files

Load these for deep knowledge in specific areas:

- `references/architecture.md` — MDE architecture, onboarding methods in depth, ASR rule internals, device groups, integration with Intune, Sentinel, and Defender XDR suite
- `references/best-practices.md` — KQL query library, ASR tuning guidance, AIR configuration, vulnerability management workflows, threat analytics usage