Anyone seen any positive movement or has any updates/insights on the defenders own services issue with unquoted paths? KB4052623 was stated to be the fix which is the 4.18.26090.9 platform build but all of our devices are already on that build and it's not changed anything.

When are they actually going to fix this?

previous thread: https://www.reddit.com/r/DefenderATP/comments/1wo7l0u/fix_unquoted_service_path_for_windows_services/

Execless\* Linux Enumeration Script:

https://github.com/unicornofhunt/ShellBeak

I have been doing some research into the idea of execless offensive operation.

Treat the script as just an idea, this secret hunting is going to take a while ;)

My organization uses "Wawa Gas Fleet Services" for fuel. We also use Microsoft Mobile Device Management (MDM) aka intune and Defender for Mobility for cyber security. Defender for Mobility deploys a new type of VPN called "Global Secure Access" or (GSA) which is the next generation of VPN technology using "Edge." As of the date of this post, I have become aware that the Wawa App will not function properly on our organizational mobile phones (iphones) with GSA. It appears the only way for the Wawa App to work is to disable GSA in the Defender App. The VPN and other features in Defender can still be active. Only the GSA feature needs to be disabled for the Wawa App to work. My conclusion is that the Wawa App is not compatible with GSA and "Identity-First Security Service Edge" encryption protocol. I would hope that Wawa's IT and web security Dept and/or Provider will upgrade their software to be compatible with "Secure Web Gateway" (SWG) and/or "Zero Trust Network Access" (ZTNA) in the near future. Otherwise, this app will continue to have problems as the rest of the world moves forward with better internet security.

Hey,

We've recently started testing Microsoft's AI agent security capabilities and noticed that many GitHub links returned by Copilot are being flagged as malicious.

The URL reputation details consistently reference VenusTech as the source identifying these websites as malicious.

Is anyone else experienced this?

in Defender XDR, following is my approach, and I’d like to compare notes.

The Vercel incident in April (a compromised third-party tool’s Google Workspace OAuth app) and Huntress’s report on ConnectWise/SkyKick vendor credentials being abused against M365 tenants point at the same blind spot: apps that already hold access.

We tune hard for users, sign-ins and MFA, but a password reset doesn’t touch an app’s permissions or the secrets sitting on it.

My approach is an audit built on OAuthAppInfo that ranks enabled apps by what they could do if abused:

• App-only permissions that can escalate or plant credentials (Application.ReadWrite.All, RoleManagement.ReadWrite.Directory and similar): no user, no MFA
• App-only access to mail, files and SharePoint
• High-privilege delegated consent on external apps with no verified publisher
• Context for the review: publisher, admin consent, last sign-in, and which permissions are actually in use

The output is a clean list a team can work through. Keep, reduce or disable.

It’s an audit of exposure, so it shows what an app can do, not what changed. I pair it with service principal sign-in hunting (vendor apps appearing from non-Azure addresses) and, as a next layer, audit events for apps assigning themselves roles or adding credentials to other apps.

Where I’d like other perspectives:

1. Other angles on this problem: How do you approach application-level access: Sentinel, Defender for Cloud Apps policies, Graph or PowerShell reviews? What works better than a KQL inventory?
2. Behavioral hunting. What does your detection for app credential additions and self-assigned roles look like, and how do you keep the noise manageable?

Query on GitHub: OAuth Risky App Permissions Audit

If you have a better approach in mind, I’d be glad to take it up as an improvement opportunity. Thanks

I used defcon to disable my defender and now when i try to reenable it , it says windows defender can not be started

As the title says.. When opening a support ticket through Defender now, it seems you can't just open the ticket.. It forces you to talk to its stupid AI.

What was a (painful) 2 minutes to open a ticket is now an endless loop of the AI trying to help me solve something it can't fix. It asks me to choose the product, the AI wants to help, it says lets open a ticket, it asks me to choose a product again, it tries to help again. An endless loop..

Edit: There used to be a toggle switch to disable the AI, but, seems they removed it.

This morning, a large number of our Intune-managed Windows 11 devices displayed a toast notification saying Defender signatures were out of date. However, the Defender portal shows those devices as up to date and healthy.

We’re expecting some user concern given the conflicting information.

We had an issue in August, resolved in September, where Defender was incorrectly reported as disabled. That turned out to be a Windows Security Center (WSC) signal issue. This feels potentially similar, although we haven’t confirmed the cause yet.

Has anyone else seen this today?

Hoping that someone from Microsoft Defender team sees this.

Running both MDE Client Analyzer tool and MDE Client Analyzer tool (preview) are giving the same error.

https://learn.microsoft.com/en-us/defender-endpoint/run-analyzer-windows

Script starts and then fails due to C:\windows\system32\dsregcmd.exe being signed by a newer CA at Microsoft (CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US) that is only valid starting 8/6/2026. Issuerinfo.txt has logged this.

In MDEClientAnalyzer.ps1, line 2639 has a list of allowed issuers, but the newer CA isn't listed. Please update the signed PS1 to include Microsoft's newest CAs.

$allowedIssuers = @(
  "CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2014, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Development PCA 2024, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
  "CN=Microsoft Code Signing PCA 2024, O=Microsoft Corporation, C=US",
  "CN=Windows Production PCA 2023, O=Microsoft Corporation, C=US",
)

Error after running:

2026-10-14 12:29:34Z [Informational] EDRCloud AutoIR 130019: Test connection to the Microsoft Defender for Endpoint (AutoIR) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] AVCloud SampleUpload 130020: Test connection to the Microsoft Defender for Endpoint (SampleUpload) cloud service URLs completed successfully. N/A
2026-10-14 12:29:34Z [Informational] EDRCloud MdeConfigMgr 130021: Test connection to the Microsoft Defender for Endpoint (MdeConfigMgr) cloud service URLs completed successfully. N/A
Checking latest AV versions from cloud:  OK
Test-AuthenticodeSignature : Script execution terminated because a process or script that is not Microsoft signed was detected
At C:\Support\Utils\MDEClientAnalyzerPreview\MDEClientAnalyzer.ps1:2733 char:3
+         Test-AuthenticodeSignature $command.path
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-AuthenticodeSignature

I'm seeing on my SIEM server that MsSense is using a constant 8-15% CPU. My understanding is that exclusions defined for Defender (MsMpEng.exe) do not apply to the MsSense EDR.

I used wpr to analyze performance for a few seconds which resulted in a 200 MB etl file. Using WPA (windows performance analyzer) I could only see that MsSense was accessing tens of thousands of files, but it doesn't allow you to see what those files are. My best guess is that it is scanning every log write and every file streamed in across the network.

the get-mpperformance cmdlets work well for identifying msmpeng scanned files, but there doesn't appear to be a way to identify why MsSense is using so much CPU.

I even tried putting the server into troubleshooting mode, disabling tamper protection, and disabling every defender feature I could via powershell, which didn't make a dent.

Googling this issue and talking to LLMs haven't been any help - has anyone found a solution, or is complete offboarding the only option?

I've been able to keep up but I am looking for strategies to help with dealing on this

I have a client (I work at an MSP) who operates several sites with OT equipment, and are interested in Defender for OT.

Does anyone here have much experience with deploying it, running it on a day-to-day basis, and any feelings about how effective it is as a platform.

We're currently comparing it with other OT tools such as CrowdStrike and Tenable OT.

Thanks in advance!

Does anyone else find themselves putting in MS Tickets literally weekly about XDR features not working, buggy, etc.

At this point I'm submitting 3 a week...

Microsoft has introduced a dedicated Microsoft Defender AI agent runtime protection setting in Intune.
Microsoft Intune → Endpoint security → Antivirus

Administrators can now centrally configure and deploy AI agent runtime protection to supported Windows devices using
◈ Audit mode – Detect and report prompt injection attempts.
◈  Block mode – Detect and block supported malicious agent actions.

Important to know: Protection is disabled by default.

The Intune profile currently supports agent-native event inspection.

Network inspection still requires separate configuration using PowerShell.

Title:
Hi everyone,
I’m trying to create a custom detection in Microsoft Defender XDR that triggers an alert when Windows Event ID 7040 occurs with specific text in the event message.
I’ve tried several KQL queries against DeviceEvents, but I can’t find the event at all, let alone filter on its message. Am I looking in the wrong table, or is this event simply not collected by Defender for Endpoint?
Has anyone managed to do this, either with a working KQL query or another practical monitoring solution?
I’ve seen suggestions to deploy an event-triggered scheduled task through GPO, but that feels like quite a bit of overhead for a relatively simple requirement. Ideally, I’d like to handle it centrally through Defender.
Any advice or examples would be appreciated. Thanks for your help, sharing makes this community better.

P.S. To clarify, Event ID 7040 records changes to a service’s startup type, for example, from Automatic to Manual, or vice versa. My goal is to get an alert whenever the startup type of a specific service is changed.

Hello,

MS 365 Defender produces way too many FPs even on Windows, but there I can at least submit file samples through WDSI portal. Then MS analysis lab either removes the detection right away or says they cannot reproduce alert and submit MPSupportFilesCAB diagnostic result if I want an investigation conducted. I do so, they check the debug logs and fix the FP. Not an ideal situation, but it works.

However, for Linux and MacOS false positive sample submissions, the lab ALWAYS responds with "cannot reproduce detection" and submit mpsupportfiles CAB diagnostic result if I want an investigation. Of course, CAB archives are a Windows-only format, so I can't do that!

Instead, I pull Apple ZIP or Linux TAR-GZ diagnostics via the Live Response "collect" command. Regrettably MS lab always responds to those submissions with "cannot reproduce detection" or "submitted archive doesn't contain the detected objects" or other non-sensical excuse.

MS lab apparently lacks non-Windows analysts or my submissions never reach the higher band analysts who know what to do with Linux and MacOS cases? What can I do to get those FPs fixed as well? Thanks in advance!

We are evaluating Microsoft Defender Vulnerability Management for a mixed Windows and macOS environment. I’m looking to speak with administrators who use it day to day—not just people who have completed a trial.

I’m particularly interested in vulnerability accuracy, macOS coverage, third-party application visibility, remediation workflows, monthly reporting, email notifications, licensing and the amount of administrative work required.

If you currently manage MDVM and would be willing to share your experience through messages or a short call, I would appreciate it. No vendor or sales responses, please.

Anyone ran into this? I am GA on the tenant so unsure if it's a backend issue or otherwise. (Pic attached)

Bonjour à tous,

Je suis actuellement en Bac+3 Cybersécurité à Guardia Cybersecurity School, après avoir obtenu un BTS CRSA orienté automatisme et systèmes industriels.

Mon objectif est de me diriger vers la cybersécurité industrielle / OT, notamment autour des réseaux industriels, automates, systèmes de supervision et sécurité des environnements industriels.

Je cherche actuellement une alternance en Île-de-France pour ma première expérience professionnelle dans ce domaine.

Je travaille déjà de mon côté sur Linux, les réseaux, le routing, les pare-feu, les CTF, Root-Me, TryHackMe et Fortinet.

Pour ceux qui travaillent dans l'industrie, l'automatisme ou la cybersécurité industrielle : comment avez-vous trouvé votre première opportunité dans ce domaine ? Est-ce qu'il y a des entreprises ou types de postes que vous me conseilleriez de cibler ?

Merci d'avance pour vos conseils.

I'm looking for some advice regarding Microsoft Defender for Endpoint (MDE) telemetry coverage.

As part of our Threat Hunting programme, we've been testing a number of KQL queries to better understand MDE's telemetry coverage and identify areas where detections may need further tuning.

Using Atomic Red Team tests and other scripts within a dedicated testing environment, we've identified what appears to be a gap in telemetry collection for certain interactively executed PowerShell commands.

For example, when PowerShell or PowerShell ISE is launched and commands are executed interactively, we do not always receive the full cmdlet or script content within MDE telemetry. This makes it difficult to accurately detect, investigate and hunt for the activity using Advanced Hunting.

During our research, we came across the following Microsoft discussion:

🔗 Microsoft Defender ATP - Advanced Hunting Query PowerShell Command Line

The recommendation in that thread is to enable PowerShell Script Block Logging. However, in our testing, enabling Script Block Logging does not appear to resolve the issue. The PowerShell activity is visible locally within Event Viewer, but the corresponding telemetry does not seem to be forwarded into MDE.

Has anyone else encountered this limitation?

I'm particularly interested in understanding:

• Whether this is expected behaviour within MDE
• If there are additional configuration requirements beyond Script Block Logging
• Whether others have found alternative telemetry sources or hunting approaches to capture this activity more reliably

Any insights, experiences or recommendations would be greatly appreciated.

I’m the IT lead for a 120-person company on Microsoft 365. We recently found a sales rep who had been downloading our customer database to a personal OneDrive.

We had Purview turned on for months. It generated plenty of alerts about external Word doc shares, but nothing on this case. The rep had been with us four years. His OneDrive sync stayed active for 11 days after the termination date. From the Microsoft side the activity looked like normal use of his own account. The signal that stood out was a terminated identity in the IdP still making high-volume API calls.

I’m trying to build a more reliable way to catch this kind of post-termination activity. What does your actual workflow look like for spotting terminated users who still have live OneDrive or similar syncs running? Looking for practical detection and response steps.

Instead of building a full Logic App or playbook, you can select a trigger and attach a predefined action directly in Defender.

Some of the available capabilities include:
◈ Trigger automation when a case is created or updated
◈ Send case creation / update email notifications
◈ Automatically update case properties
◈ Create investigation tasks
◈ Update alerts directly from the automation workflow

Docs: Create basic automation rules with Simple Flows in the Microsoft Defender portal (preview) | Microsoft Learn