Version 1.1 of the Microsoft LNK recovery script with added support to restore from the Volume Shadow Copy Service released
https://github.com/microsoft/MDE-PowerBI-Templates/blob/master/ASR_scripts/AddShortcuts.ps1
My blog post from July last year became more relevant since last Friday then I had hoped.
But now is a good time to think about using the gradual rollout process for Microsoft Defender updates.
https://cloudbrothers.info/en/gradual-rollout-process-microsoft-defender/
One of the features of Microsoft Defender Antivirus that, in my opinion, is overlooked by most, is the ability to control the rollout of all components of Microsoft Defender Antivirus by selecting different release channels. This allows for a more gradual rollout of security intelligence updates, the engine as well as the AV platform. Different update types But let’s take a step back and get a common understanding whats the difference between those different updates is and how they are deployed.
Microsoft has released their own guidance and scripting to recover from #ASRmagedon
Great rule for finding out via advanced hunting what defender deleted
```
DeviceEvents
| where ActionType == "AsrOfficeMacroWin32ApiCallsBlocked" and Timestamp >= datetime("2023-01-13 00:00:00Z")
| order by Timestamp
| where FileName endswith ".lnk"
```
Thanks reddit
Georg311
Fabian Bader
vermiliondraught
Matt Kirby
Gary Blosser