RT by @SwiftOnSecurity: Defender AV Platform v4.18.25070.5
◽Enhanced Passive Mode Scanning Behavior ◽Improved Tamper Protection Handling ◽Digital Signature Verification Performance Boost ◽Refined ASR Rule Exclusion Processing
🐦🔗: https://nitter.oksocial.net/fabian_bader/status/1955339624777228540#m
[2025/08/12 18:44]
Defender AV Platform v4.18.25070.5
◽Enhanced Passive Mode Scanning Behavior
◽Improved Tamper Protection Handling
◽Digital Signature Verification Performance Boost
◽Refined ASR Rule Exclusion Processing
As of 07.03.2023 (Release of signature 1.383.1159.0) tamper protection is no longer enforcing "Allow Scanning Network Files".
If you still want this to be enabled, make sure your Intune or GPO configuration has this value set.
Easy script to update AV exclusions on #Exchange 2019 #MDAV #MDE
https://github.com/0x3e4/PowerShell/blob/main/Exchange/Get-Exchange2019AVExclusions/Get-Exchange2019AVExclusions.ps1
Update on the #Exchange Server Antivirus Exclusions
Microsoft finally removed the recommendation to exclude PowerShell.exe and w3wp.exe and two others from the official documentation
For years we have been saying how running antivirus (AV) software on your Exchange Servers can enhance the security and health of your Exchange organization. We’ve also said that if you are deploying file-level scanners on Exchange servers, make sure that the appropriate exclusions, such as director...
100% pure cloud based management of #MDE devices is coming closer.
See the latest Microsoft blog "Push ASR rules with Security Settings Management on Microsoft Defender for Endpoint managed devices"
In May 2022, we announced the general availability of Security Settings Management for Microsoft Defender for Endpoint. This release empowered security teams to configure devices with their desired antivirus, EDR and firewall settings without needing to deploy and implement additional tools or infra...
Just published a small update to my "The Hitchhiker's Guide to Microsoft Defender for Endpoint exclusions" post, adding information on the new tamper protection capabilties for custom exclusions.
Since Microsoft Defender for Endpoint is a suite of products, rather than just one single piece of software, there are various places where you can create exclusions for different features. Also, there are integrations in other products, that result in possible side effects when enabling certain settings. Most of these products have separate documentations, there is no single documentation page that contains all the information about exclusions available in Microsoft Defender for Endpoint.
Version 1.1 of the Microsoft LNK recovery script with added support to restore from the Volume Shadow Copy Service released
https://github.com/microsoft/MDE-PowerBI-Templates/blob/master/ASR_scripts/AddShortcuts.ps1
My blog post from July last year became more relevant since last Friday then I had hoped.
But now is a good time to think about using the gradual rollout process for Microsoft Defender updates.
https://cloudbrothers.info/en/gradual-rollout-process-microsoft-defender/
One of the features of Microsoft Defender Antivirus that, in my opinion, is overlooked by most, is the ability to control the rollout of all components of Microsoft Defender Antivirus by selecting different release channels. This allows for a more gradual rollout of security intelligence updates, the engine as well as the AV platform. Different update types But let’s take a step back and get a common understanding whats the difference between those different updates is and how they are deployed.
SwiftOnSecurity
Fabian Bader
Raphael
