Defender for Endpoint Defender for Endpoint

    connections -output json
    processes -name powershell.exe
    fileinfo C:\Users\Public\invoice.hta
    getfile C:\ProgramData\suspicious.dll
        

    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("Invoke-WebRequest", "DownloadString", "iwr", "irm")
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine
        

    DeviceEvents
    | where ActionType in ("AsrLsassCredentialTheftAudited", "AsrLsassCredentialTheftBlocked")
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
        

    DeviceFileEvents
    | where FileName matches regex @"(?i)(readme|recover|decrypt|how_to).*"
    | summarize Notes = count() by DeviceName, FolderPath, bin(Timestamp, 10m)
    | where Notes > 5
        

    DeviceProcessEvents
    | where FolderPath has_any ("\Temp\", "\AppData\Local\Temp\")
    | where InitiatingProcessSignerType !~ "Microsoft"
    | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessSignerType
        

    DeviceProcessEvents
    | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
    | where FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
        

    DeviceProcessEvents
    | where FileName in~ ("psexec.exe", "wmic.exe", "wmiprvse.exe")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
        

    DeviceEvents
    | where ActionType in ("UserAccountAddedToLocalGroup", "LocalUserAccountCreated")
    | project Timestamp, DeviceName, AccountName, AdditionalFields
        

    DeviceFileEvents
    | where InitiatingProcessAccountName !startswith "NT AUTHORITY"
    | where FolderPath startswith "\\?\USBSTOR" or FolderPath has "Removable"
    | summarize Files=count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 15m)
    | where Files > 100
        

    DeviceProcessEvents
    | where ProcessCommandLine has_any ("Login Data", "Cookies", "Web Data")
    | where FileName in~ ("cmd.exe", "powershell.exe", "python.exe", "7z.exe")
        

    DeviceTvmSoftwareVulnerabilities
    | where VulnerabilitySeverityLevel == "High"
    | summarize Vulns=count() by DeviceId, CveId
    | top 50 by Vulns desc
        

    DeviceInfo
    | where OnboardingStatus != "Onboarded" or SensorHealthState != "Active"
    | project Timestamp, DeviceName, OnboardingStatus, SensorHealthState, OSPlatform
        

    # ASR-Regeln lokal setzen
    $ids = @(
      "d4f940ab-401b-4efc-aadc-ad5f3c50688a",
      "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b",
      "d1e49aac-8f56-4280-b9ba-993a6d77406c"
    )
    $actions = @(1,1,1)
    Add-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions $actions
    Set-MpPreference -EnableControlledFolderAccess Enabled
    Set-MpPreference -EnableNetworkProtection Enabled
        

    {
      "platforms": "windows10",
      "technologies": "mdm,microsoftSense",
      "settings": [
        {"settingDefinitionId": "device_vendor_msft_policy_config_defender_attacksurfacereductionrules", "value": "Configured"},
        {"settingDefinitionId": "device_vendor_msft_policy_config_defender_networkprotection", "value": "block"},
        {"settingDefinitionId": "device_vendor_msft_policy_config_defender_tamperprotection", "value": "enabled"}
      ]
    }