Attack Disruption
- It uses Defender XDR’s ability to correlate signals from many different sources into a single, high-confidence incident through insights from endpoints, identities, email and collaboration tools, and SaaS apps.
- It identifies assets controlled by the attacker and used to spread the attack.
- It automatically takes response actions across relevant Microsoft Defender products to contain the attack in real-time by containing and disabling affected assets.
Previous blog post on Attack Disruption Automatic Attack Disruption Explained – SEC-LABS R&D
With all the capabilities provided within Attack Disruption, it’s important that Defender XDR is configured correctly. For instance, if you have configured a gMSA account for the MDI actions, and it does not work properly, it will affect disruption negatively.
MDE Prereqs
- Minimum Sense version for contain user:v10.8470
- Auto IR: Full – remediate threats automatically (recommended for full coverage, no automated response turns off automatic disruption for device group)
- Endpoint discovery set to Standard (not basic)
In MDE the most common configuration improvements seen are:
- Sample submission is not configured to send files automatically
- Cloud block out level is not set to high
- Cloud block timeout period is not set to 50s
more on MDE in this previous post 3 common Defender for Endpoint configuration errors
MDI Prereqs
- Validate DC auditing
- Validate permissions for Action Account or use LocalSystem
- Validate no other systems interfere with attack disruption, such as systems for auto activating users
MDO Prereqs
- Mailboxes are required to be hosted in Exchange Online.
- The following mailbox events need to be audited by minimum:
- MailItemsAccessed
- UpdateInboxRules
- MoveToDeletedItems
- SoftDelete
- HardDelete
- Safelinks policy needs to be present.
MDA Prereqs
- Microsoft Defender for Cloud Apps must be connected to Microsoft Office 365 through the connector
- App Governance must be turned on
Happy Hunting!