Cyber Security Defense with Microsoft Defender.

✍ Scribed by Dave Kawula; Emile Cabot

• Publisher: MVPDays Publishing
• Year: 2021
• Tongue: Russian
• Leaves: 248
• Category: Library

✦ Table of Contents

Acknowledgments
From Dave
About the Authors
Dave Kawula – Microsoft MVP
Cristal Kawula – Microsoft MVP
Emile Cabot – Microsoft MVP
Cary Sun – Microsoft MVP
John O’Neill Sr – Re-Connect Microsoft MVP
Introduction: MVPDays Online
Sample Files
Additional Resources
Chapter 1: Setting up your Azure Subscription from Scratch
Chapter 2: Configuring Windows Admin Center and Azure Arc
2.1 Configure Windows Admin Center
2.2 Configure Azure Integration
2.3 Setup Azure Arc
2.4 Configure Azure Updates
2.5 Azure Backup
2.6 Verify Backup Jobs with Azure Backup
2.7 Onboard Servers to Azure Security Center
2.8 Configure Azure Site Recovery
2.9 Configure Vulnerability Management with Microsoft Defender via Azure Arc
Chapter 3: Microsoft Defender for Cloud
3.1 Enabling Microsoft Defender for Cloud on Azure Resources and Azure Arc Resource
Chapter 4: Microsoft Defender Advanced Threat Protection ATP
4.1 Onboarding a Desktop with Microsoft Defender ATP
4.2 Reviewing an Incident with Microsoft Defender Advanced Threat Protection
Chapter 5: Simulating a Ransomware Attack on Windows 10
5.1 Running KnowBe4 Ransomware Simulator on Windows 10 no Security Baselines
5.2 Locking Down older systems with Group Policy Security Baselines and Security Compliance Manager 4.0
5.3 Locking Down Windows Server 2019/2022 and Windows 10/11 with Group Policy Security Baselines via Security Compliance Toolkit 1.0
5.4 Running KnowBe4 Ransomware Simulator on Windows 10 with Security Baselines
5.2 Enabling Ransomware Protection on Windows 10
5.3 – Controlled Folder Access vs. Ransomware Attack with PowerShell
5.3 – No Controlled Folder Access vs. Ransomware Attack with PowerShell
Chapter 6: Attack Simulation – Document Drops Back Door
6.1 – Document Back Door Drop vs. Microsoft Defender ATP
Chapter 7: Attack Simulation – PowerShell Fileless Attack
7.1 – PowerShell fileless attack (Process Hollowing Attack) no Exploit Guard
7.2 – Enable Exploit Protection
7.3 – PowerShell fileless attack (Process Hollowing Attack) with Exploit Guard
Chapter 8: Attack Simulation – Live Response
8.1 – Live Response in Microsoft Defender Security Center
Chapter 9: Attack Remediation – Chat with Threat Experts at Microsoft
9.1 – Apply to the Microsoft Threat Experts Program
Chapter 10: Recovering from Ransomware using Azure Site Recovery
Notes from the Field
Why Airgapped Replicas are the only choice
Why Planned Failover is no longer an option
Failover Now is the only Option
Watch you Six (Clock)
Do not connect your Azure Site Recovery Virtual Machines to a live Site-to-Site VPN
When can I get back into my data?
Ok, so I didn’t listen and lost everything. Now what?
Don’t forget to tune your Replication Policy
Testing Failover can be a quick Ransomware Fix
Reset Settings for your Azure Site Recovery Hyper-V Host
Enable Diagnostic Logging for Azure Site Recovery
Zero Day time to Failover
Assuming an Admin Level breach Failing over 100 % to Azure
10.1 Executing a PowerShell-based Ransomware Attack on Domain Controllers.
10.2 Taking Down Production by Killing Domain Controllers with Ransomware
10.3 Survival Mode Recovering to Azure
Tick Tock time to make a decision – We are Recovering to Azure
10.4 Performing the Double Swing Recovery
Chapter 11: Microsoft Defender 365
11.1 A lap around Microsoft 365 Defender Portal
Chapter 12: Join us at MVPDays and meet great MVP’s like this in person
Live Presentations
Video Training
Live Instructor-led Classes
Consulting Services