This is a re-shoot of episode 22, so sorry it’s out of order…
Steve and Adam talk about configuring AppLocker Policies and take a look at Advanced Threat Hunting.
- 00:00 - Intro
- 02:28 - Deploy Windows Defender Application Control policies by using Microsoft Intune
https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune - 04:39 - Application Control for Windows
https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control - 05:41 - Essential Eight
https://www.cyber.gov.au/acsc/view-all-content/essential-eight/essential-eight-explained - 08:01 - Reduce attack surfaces with attack surface reduction rules
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction - 11:48 - Review attack surface reduction events in the Microsoft Defender Security Center
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#review-attack-surface-reduction-events-in-the-microsoft-defender-security-center - 13:24 - Proactively hunt for threats with advanced hunting
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview - 15:25 - SQL to Azure Monitor log query cheat sheet
https://docs.microsoft.com/azure/azure-monitor/log-query/sql-cheatsheet - 16:55 - Create and manage custom detection rules
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules - 23:57 - Exploit protection
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exploit-protection - 29:29 - Microsoft Defender Advanced Threat Protection baseline settings for Intune
https://docs.microsoft.com/mem/intune/protect/security-baseline-settings-defender-atp?pivots=atp-april-2020 - 34:06 - Wrapping up