The Curious Engineer

All blogs / Security

Microsoft Defender for Endpoint Blog

techcommunity.microsoft.com/category/microsoft-defender-for-endpoint/blog/microsoftdefenderatpblog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and...

SecurityMicrosoft blogsMicrosoft Tech Community

’17’18’19’20’21’22’23’24’25’26
Posts
354 from 4 Sep 2017 to 29 Oct 2026
Posting
monthly (14 in the last year)
Kind
company blog

2026 13

  1. Defending Linux in the age of AI-operated attacks
  2. Secure Linux desktops with Microsoft Defender
  3. New Privileged Token Context Telemetry Boosts Advanced Hunting in Microsoft Defender
  4. Reduce unnecessary internet exposure with Microsoft Defender
  5. Introducing scheduled antivirus scans on Microsoft Defender Linux
  6. Elevate your telemetry using custom data collection in Microsoft Defender
  7. Microsoft Defender now monitors RPC activity
  8. How Microsoft Defender used predictive shielding to proactively disrupt a ransomware attack
  9. Introducing selective response actions for high-value assets in Microsoft Defender
  10. Assess Secure Boot status with Microsoft Defender
  11. Introducing effective settings: See security configurations enforced on your device
  12. Transparent and customizable onboarding for modern and legacy Windows devices
  13. Introducing library management in Microsoft Defender

2025 13

  1. Ignite 2025: Microsoft Defender now prevents threats on endpoints during an attack
  2. End of Windows 10 Support: What Defender Customers Need to Know
  3. Multi-tenant endpoint security policies distribution is now in Public Preview
  4. Maintain connectivity for essential services with selective network isolation
  5. Microsoft’s participation in MITRE ATT&CK® Evaluations: Enterprise 2025
  6. Behavior monitoring is now generally available for Microsoft Defender for Endpoint on macOS
  7. Manage global exclusion policies for Linux across both AV and EDR
  8. Discover how automatic attack disruption protects critical assets while ensuring business continuity
  9. Defender for Endpoint successfully passes the AV-Comparatives 2025 Anti-Tampering Test
  10. Sensor Disconnection Notifications with Microsoft Defender for IoT and Microsoft Sentinel 🚀
  11. Block malicious command lines with Microsoft Defender for Endpoint
  12. Get greater visibility with aggregated reporting of endpoint telemetry signals
  13. Defender for Endpoint extends support to ARM-based Linux servers

2024 14

  1. Protect your single-core Linux servers with Defender
  2. The unified agent now combines protection across endpoints, OT devices, identities, and DLP
  3. Security settings management is available for multi-tenant environments in Microsoft Defender XDR
  4. Microsoft Defender for Endpoint’s Safe Deployment Practices
  5. Detect compromised RDP sessions with Microsoft Defender for Endpoint
  6. Reduce friction and protect faster with simplified Android onboarding
  7. Get more device control flexibility with BitLocker settings in Defender for Endpoint
  8. Host Microsoft Defender data locally in Switzerland
  9. Detect suspicious processes running on hidden desktops
  10. Simplify triage with the new Alert Timeline
  11. Introducing Single Sign-On (SSO) for Sensor Console: Enhanced Security and Streamlined Access
  12. Offline Security Intelligence Update is now GA
  13. Use the new investigation and response capabilities for macOS and Linux
  14. Manage your devices with ease using dynamic rules for device tagging in Microsoft Defender

2023 22

  1. Get greater flexibility across iOS deployments with User Enrollment support in Defender for Endpoint
  2. Simplified security settings management is now generally available
  3. Announcing a streamlined device connectivity experience for Microsoft Defender for Endpoint
  4. Microsoft Defender data can now be hosted locally in Australia
  5. Announcing mobile device tagging for iOS and Android
  6. Optimizing endpoint security with Microsoft Defender for Endpoint's flexible licensing options
  7. Analyze IoT/OT device firmware with Microsoft Defender for IoT
  8. Use the new eBPF-based sensor for Defender for Endpoint on Linux
  9. Announcing device isolation and AV scanning for Linux and macOS
  10. Manage security settings for Windows, macOS, and Linux natively in Defender for Endpoint
  11. Announcing the monthly security summary report for Microsoft Defender for Endpoint
  12. Microsoft Defender for IoT moves to site-based licensing for protecting OT environments
  13. Discovering internet-facing devices using Microsoft Defender for Endpoint
  14. Enrich your advanced hunting experience using network layer signals from Zeek
  15. Defender for Endpoint and disconnected environments. Cloud-centric networking decisions
  16. Microsoft awarded Best Advanced Protection for Corporate and Consumer Users by AV-TEST
  17. Defender for Endpoint and disconnected environments. Which proxy configuration wins?
  18. Push ASR rules with Security Settings Management on Microsoft Defender for Endpoint managed devices
  19. Announcing device isolation support for Linux
  20. Recovering from Attack Surface Reduction rule shortcut deletions
  21. Introducing tamper protection for exclusions
  22. Disconnected environments, proxies and Microsoft Defender for Endpoint

2022 45

  1. New network-based detections and improved device discovery using Zeek
  2. Announcing new removable storage management features on Windows
  3. Use the new Microsoft 365 Defender API for all your alerts
  4. Section 52 Releases an Open Source Forensics Tool for Siemens PLCs
  5. Highlighting IoT/OT Security in the 2022 Microsoft Digital Defense Report
  6. Microsoft Defender for Endpoint announcements at Microsoft Ignite 2022
  7. Detecting and remediating command and control attacks at the network layer
  8. Public Preview Announcement: OT-Enabled SOC with Microsoft Sentinel and Defender for IoT
  9. Tamper protection will be turned on for all enterprise customers
  10. Defender for Endpoint is now available on Android corporate-owned personally enabled devices
  11. Improving device discoverability and classification using Defender for Identity
  12. Attack Surface Reduction (ASR) Rules Report 2.0 in Microsoft 365 Defender
  13. New Mobile Threat Defense capabilities for Android & iOS
  14. How to deploy Attack Surface Reduction rules to Azure VMs using Azure Guest Configurations
  15. Network Protection and Web Protection for macOS and Linux
  16. Tamper protection on macOS is now generally available
  17. New Device Health Reporting for Microsoft Defender for Endpoint is now generally available
  18. Announcing File page enhancements in Microsoft Defender for Endpoint
  19. Stream Microsoft Defender for IoT alerts to a 3rd party SIEM
  20. Introducing the new alert suppression experience
  21. Mobile Network Protection for Defender for Endpoint on Android and iOS now Generally Available
  22. Prevent compromised unmanaged devices from moving laterally in your organization with “Contain”
  23. Mobile device support is now available for US Government Customers using Defender for Endpoint
  24. Hunting for network signatures in Microsoft Defender for Endpoint
  25. Evaluation Lab: new domain-joined devices support in Public Preview
  26. Investigating an Alert Using Defender for IoT and Wireshark
  27. Troubleshooting mode for Microsoft Defender for Endpoint now Generally Available
  28. Announcing the public preview of Defender for Endpoint personal profile for Android Enterprise
  29. Security Settings Management in Microsoft Defender for Endpoint is now generally available
  30. Tamper Protection is now available on macOS
  31. Device Inventory - The evolution of the endpoint view
  32. Enhanced Antimalware Protection in Microsoft Defender for Endpoint Android
  33. Enhanced antimalware engine capabilities for Linux and macOS
  34. New Reporting Functionality for Device Control and Windows Defender Firewall
  35. Unified submissions in Microsoft 365 Defender now Generally Available!
  36. Secure your Medical Devices with Microsoft Defender for IoT
  37. Microsoft Defender for IoT for Device Builders in Public Preview
  38. Announcing expanded support and functionality for Live Response APIs
  39. Defending against ransomware with Microsoft Defender for Endpoint and Intel TDT: A Case Study
  40. Microsoft Defender for IoT - General Release Update
  41. The Splunk Add-on for Microsoft Security is now available
  42. Micro-Agent Now Available for Public Preview for IoT Edge Devices
  43. Deprecating the legacy SIEM API - Postponed
  44. Microsoft Defender for Endpoint Plan 1 Now Included in M365 E3/A3 Licenses
  45. Experience zero-touch onboarding with Microsoft Defender for Endpoint on iOS

2021 58

  1. Microsoft Partners with ServiceNow to Help Manage and Secure Manufacturing Assets (Preview)
  2. Understanding Cyber-Physical System and IoT/OT Risk, Featuring Gartner®
  3. Protect printers, cameras and the rest of your IoT devices starting today!
  4. Protect your printers, cameras and the rest of your IoT devices starting today!
  5. Announcing Preview of New Security Management Capabilities for Microsoft Defender for Endpoint.
  6. Evaluation Lab: Expanded OS support & Atomic Red Team simulations
  7. Announcing tamper protection for mobile devices
  8. AI-driven adaptive protection in Microsoft Defender for Endpoint
  9. Microsoft Defender for Endpoint Plan 1 Now Generally Available
  10. Grow Your IoT Business with Microsoft Defender for IoT and Device Certification
  11. Enabling IoT/OT Threat Monitoring in Your SOC with Microsoft Sentinel
  12. Boost protection of your Linux estate with behavior monitoring, extended distro coverage, and more
  13. Web content filtering now generally available on Windows
  14. Announcing live response for macOS and Linux
  15. Defending Windows Server 2012 R2 and 2016
  16. Device Control Device Installation update
  17. Announcing performance analyzer for Microsoft Defender Antivirus
  18. Introducing Microsoft Defender for Endpoint Plan 1
  19. Make sure Tamper Protection is turned on
  20. Announcing Apple M1 native support
  21. Public Preview: Custom file IoC enhancements and API schema update
  22. Best practices for optimizing custom indicators
  23. Eliminating IoT vulnerabilities using CIS Benchmarks and Azure Defender for IoT
  24. Microsoft Defender for Endpoint Ninja Training: August 2021 update
  25. How to Gain More from your Connection to an OT Network
  26. Download quarantined files now Generally Available
  27. Microsoft scores highest in threat visibility coverage for MITRE ATT&CK for ICS
  28. Protect your removable storage and printers with Microsoft Defender for Endpoint
  29. Announcing live response API public preview
  30. Evaluation lab updates: device renewal and new simulations
  31. Why protecting IoT devices using a Zero Trust approach is a security imperative
  32. Announcing new capabilities on Android and iOS
  33. Welcome to Microsoft 365 Defender!
  34. Microsoft Defender for IoT Ninja Training
  35. How to migrate advanced hunting to Microsoft 365 Defender
  36. Cloud-delivered IoT/OT threat intelligence — now available for Defender for IoT
  37. Designing a Robust Defense for Operational Technology Using Azure Defender for IoT
  38. How to Quick Start with Defender for IoT Sensor onboarding and integration into Azure Sentinel
  39. Endpoint Discovery - Navigating your way through unmanaged devices
  40. Configuring exclusions for Splunk on RedHat Linux 7.9
  41. Enhancing Linux antivirus with behavior monitoring capabilities!
  42. Mac updates: Control your USB devices with Microsoft Defender for Endpoint on Mac!
  43. Migrate advanced hunting from Microsoft Defender for Endpoint to Microsoft 365 Defender
  44. Announcing a global switch for tamper protection
  45. Investigating the Print Spooler EoP exploitation
  46. One app for VPN and mobile threat defense
  47. Delivering world class SecOps experiences
  48. MITRE ATT&CK Techniques now available in the device timeline
  49. Protecting sensitive information on devices
  50. Microsoft Defender for Endpoint Ninja Training: February 2021 update
  51. Microsoft Defender Antivirus: 12 reasons why you need it
  52. Windows Virtual Desktop support is now generally available
  53. How to use tagging effectively (Part 3) - Scripting tags
  54. Microsoft Defender for Endpoint: Automation defaults are changing
  55. EDR for Linux is now generally available
  56. How to use tagging effectively (Part 2)
  57. How to use tagging effectively (Part 1)
  58. Azure Defender for IoT Raw-Data and ICS MITRE ATT&CK Matrix Mapping via Azure Sentinel

2020 58

  1. Announcing EDR in block mode general availability
  2. Microsoft Defender for Endpoint on iOS is generally available
  3. EDR for Linux is now available in public preview
  4. Join us for the Microsoft Defender for Endpoint AMA cross platform edition!
  5. Azure Defender for IoT is now in public preview
  6. Protecting organizations from the latest evolution of mobile ransomware
  7. 451 Research publishes a report about Microsoft Defender for Endpoint
  8. SHA-2 signing enforcement on Windows 7 and Windows Server 2008 R2 is almost here!
  9. Azure Defender for IoT: Agentless Security for OT
  10. Microsoft Defender for Endpoint adds depth and breadth to threat defense across platforms
  11. Microsoft Defender ATP Ninja Training: September 2020 update
  12. Microsoft Defender ATP for Mac is moving to system extensions
  13. How behavioral blocking & containment stops post-exploitation tools like BloodHound, Kerberoasting
  14. A new look for threat analytics
  15. Microsoft Defender ATP Ninja Training: August 2020 update
  16. Introducing an improved timeline investigation with event flagging
  17. Webinar: How to maximize Microsoft Defender ATP configuration using attack simulations
  18. Multi-tenant access for Managed Security Service Providers
  19. Changes in the support case submission experience
  20. SHA-2 signing enforcement on Windows 7 and Windows Server 2008 R2
  21. Become a Microsoft Defender for Endpoint Ninja
  22. Microsoft Defender ATP awarded a perfect 5-star rating by SC Media
  23. An update on Web Content Filtering
  24. Configuring Microsoft Defender Antivirus for non-persistent VDI machines
  25. Improving defenses against Exchange server compromise
  26. Webinar: How to get started with Microsoft Defender ATP
  27. Microsoft Defender ATP for Linux is now generally available!
  28. Announcing Microsoft Defender ATP for Android
  29. A deeper dive into the APT29 MITRE ATT&CK evaluation
  30. Microsoft Defender ATP has a new UEFI scanner
  31. New partnerships with innovative leaders helps you fight advanced threats!
  32. Say hello to the new alert page in Microsoft Defender ATP
  33. Migrate the old Power BI App to Microsoft Defender ATP Power BI templates!
  34. Microsoft Defender ATP evaluation lab breach & attack simulators are now available in public preview
  35. Demystifying attack surface reduction rules - Part 4
  36. Defending networks against human-operated ransomware
  37. Automate the boring for your SOC with automatic investigation and remediation!
  38. Indicators enhancements: Allow/Block by certificates & more
  39. Demystifying attack surface reduction rules - Part 3
  40. Onboarding and servicing non-persistent VDI machines with Microsoft Defender ATP
  41. Deploy Microsoft Defender ATP for Mac in just a few clicks
  42. MITRE ATT&CK evaluation results
  43. Demystifying attack surface reduction rules - Part 2
  44. Demystifying attack surface reduction rules - Part 1
  45. Live response for earlier versions of Windows is now in public preview
  46. Secure your remote workforce with Microsoft Defender ATP
  47. Microsoft Defender ATP service notification improvements
  48. Connect the dots using a device network overview Power BI report
  49. Raw data export: Announcing Microsoft Defender ATP Streaming API GA
  50. Webinar: Stopping attacks in their tracks through behavioral blocking and containment
  51. Microsoft Defender ATP for Linux is coming! ...And a sneak peek into what’s next
  52. Put regulation fears to rest when deploying Microsoft Defender ATP
  53. Web content filtering with Microsoft Defender ATP now in public preview
  54. Extending Microsoft Defender ATP network of partners
  55. Webinar: Elevate your endpoint security with Microsoft Defender ATP
  56. Block Access to Unsanctioned Apps using Microsoft Defender ATP & Microsoft Cloud App Security
  57. Updates to Microsoft Online Services Terms
  58. Enforcement of TLS 1.2 for connections to Microsoft Defender ATP

2019 60

  1. EDR capabilities for macOS have now arrived
  2. Advanced hunting data schema changes
  3. Short & sweet educational videos on Microsoft Defender for Endpoint
  4. Create custom reports using Microsoft Defender ATP APIs and Power BI
  5. Recordings now online: Microsoft Defender ATP sessions from #MSIgnite 2019
  6. Microsoft Defender ATP for Mac - EDR in Public Preview
  7. How insights from system attestation and advanced hunting can improve enterprise security
  8. Webinar: Fighting the “Unknown Unknowns” with Microsoft and Morphisec
  9. Experts on demand: now generally available
  10. Microsoft Defender ATP sessions at #MSIgnite 2019
  11. Tamper protection now generally available for Microsoft Defender ATP customers
  12. Manage Windows Defender Firewall with Microsoft Defender ATP and Intune
  13. Forrester names Microsoft a Leader in 2019 Endpoint Security Suites Wave
  14. Enhanced visibility into web threats with Microsoft Defender ATP
  15. Microsoft Defender ATP EDR support for Windows Server 2008 R2 now generally available
  16. New! API Explorer and Connected applications
  17. MITRE ATT&CK technique info in Microsoft Defender ATP alerts
  18. Microsoft Defender ATP supports custom IOCs for URLs, IP addresses, and domains
  19. Enhance your SOC with Microsoft Defender ATP Automatic Investigation and Remediation
  20. Test security products the right way and find new protection features with MDATP evaluation lab
  21. Hunting for reconnaissance activities using LDAP search filters
  22. Advanced hunting updates: USB events, machine-level actions, and schema changes
  23. Gartner names Microsoft a Leader in 2019 Endpoint Protection Platforms Magic Quadrant
  24. Microsoft Defender ATP 'Ask Me Anything' August 2019 - Summary
  25. Migrate your custom Threat Intelligence (TI) to indicators!
  26. Microsoft Defender Advanced Threat Protection is now available as an offer to US GCC High customers
  27. The Golden Hour remake - Defining metrics for a successful security operations
  28. Download files for in-depth investigation
  29. Microsoft Defender ATP evaluation lab is now available in public preview
  30. Microsoft Defender ATP Streaming API - Public Preview - DIY example
  31. MDATP Monitoring network connection behind forward proxy - Public Preview
  32. How automation brings value to your security teams
  33. Microsoft Defender ATP for Mac is here!
  34. Microsoft Defender ATP alert categories are now aligned with MITRE ATT&CK!
  35. Microsoft Defender ATP automation & cloud app discovery now available in previous Windows 10 builds!
  36. Microsoft Defender ATP API - Terms of use update
  37. MDATP Python automation - Automate machine isolation with Python script
  38. Microsoft Defender ATP unified indicators of compromise (IoCs) experience
  39. Microsoft Defender ATP for Mac now in open public preview
  40. Upcoming webinar 📣 The Power of Advanced Hunting - Unleash the hunter in you!
  41. Incident response at your fingertips with Microsoft Defender ATP live response
  42. Updates to attack surface reduction rules for Office apps
  43. Microsoft Defender ATP third-party solution integrations
  44. Microsoft Threat Experts reaches general availability
  45. Protecting disconnected devices with Microsoft Defender ATP
  46. Announcing Microsoft Defender ATP API updates
  47. Microsoft Defender ATP & Microsoft Cloud App Security Integration
  48. Microsoft Defender ATP built-in threat summary and health reports
  49. Tamper protection in Microsoft Defender ATP
  50. Announcing Microsoft Defender ATP for Mac
  51. MITRE evaluation highlights industry-leading EDR capabilities in Windows Defender ATP
  52. Microsoft Threat Experts: Case studies for managed threat hunting service
  53. Windows Defender ATP’s EDR capability for Windows 7 and Windows 8.1 now generally available
  54. Inside SecOps: Are we impacted by this new APT campaign?
  55. Ticketing system integration – Alert update API
  56. Help protect the exec – go with the Flow!
  57. WDATP API “Hello World” (or using a simple PowerShell script to pull alerts via WDATP APIs)
  58. Is your SOC running flat with limited RBAC?
  59. New integration for mobile devices with Corrata!
  60. Automated machine tagging in just a few simple steps...

2018 45

  1. Automating Security Operations Using Windows Defender ATP APIs with Python and Jupyter Notebooks
  2. Conditional access: Ensuring that only secure users and devices get access to sensitive data
  3. What’s new in Windows Defender ATP, November 2018
  4. New! Windows Defender ATP Incidents narrate the end-to-end attack story
  5. Automating investigation and response for memory-based attacks
  6. SecOps is more effective thanks to Microsoft Windows Defender Advanced Threat Protection
  7. Start consuming Windows Defender ATP alerts data on IBM QRadar SIEM
  8. Protecting Windows Server with Windows Defender ATP
  9. Presenting our mutual Conditional Access integration between WDATP ans SharePoint
  10. Windows Defender ATP related sessions at Microsoft Ignite
  11. WDATP September 2018 preview features are out!
  12. Multi-layer defense against attacks that abuse the .settingcontent-ms file type
  13. Hunting tip of the month: Downloads originating from email links
  14. Optimized reporting latency and expedite mode
  15. Advanced hunting now includes network adapters information
  16. Hunting tip of the month: Browser downloads
  17. Attack inception: Compromised supply chain within a supply chain poses new risks
  18. Windows Defender ATP now compliant with ISO 27018 and EU Model Clauses
  19. Getting Started with Windows Defender ATP Advanced Hunting
  20. Hunting tip of the month: PowerShell commands
  21. Windows Defender ATP EDR capability for Windows 7 SP1 and Windows 8.1 is now in public preview!
  22. Addressing geo-sovereignty with UK data storage
  23. DynoRoot (CVE-2018-1111) exposed via Advanced Hunting
  24. Machine learning vs. social engineering
  25. What’s new in the WDATP Portal?
  26. Go hunt, join us on GitHub
  27. Azure Security Center integration with Windows Defender ATP - Preview available!
  28. Sample queries now on GitHub
  29. Announcing new exciting capabilities of Windows Defender ATP (April 2018)
  30. Enhancing conditional access with machine-risk data from Windows Defender Advanced Threat Protection
  31. Hunting down Dofoil with Windows Defender ATP
  32. Unleash the Hunter in You
  33. NEW threat analytics dashboard for Spectre and Meltdown
  34. WDATP preview features are now ON!
  35. Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign
  36. Analysis of FinFisher malware used by NEODYMIUM group
  37. Microsoft AI stops Emotet outbreak in milliseconds
  38. Private Preview time is NOW
  39. Stopping attacks that use SLK files
  40. Windows Defender ATP support for Windows 7 and Windows 8.1
  41. Windows Defender ATP online resources
  42. Zero-day exploit for Flash vulnerability CVE-2018-4878
  43. Protecting customers from being intimidated into making an unnecessary purchase
  44. Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems
  45. Updated: Meltdown and Spectre - new vulnerability in modern processors - the WDATP angle

2017 26

  1. Detonating a bad rabbit: Windows Defender Antivirus and layered machine learning defenses
  2. What's new in the WDATP Portal? Dec 26th, 2017
  3. Office 365 ATP defense for corporate networks against recent Office exploit attacks
  4. How we detect script-based attacks with Windows Defender ATP & AMSI
  5. Connecting servers without Internet access to Windows Defender ATP
  6. What is reflective DLL loading and how can Windows Defender ATP detect it?
  7. Microsoft partners extend Windows Defender ATP across platforms
  8. What’s new in the WDATP Portal? July 24th, 2017
  9. Announcing the Windows Defender Advanced Threat Protection ISO 27001 audit assessment report
  10. Exploit for CVE-2017-8759 detected and neutralized
  11. Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene
  12. Windows Defender ATP machine learning: Detecting new and unusual breach activity
  13. Detecting stealthier cross-process injection techniques with Windows Defender ATP
  14. Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
  15. Windows 10 platform resilience against the Petya ransomware attack
  16. New ransomware, old techniques: Petya adds worm capabilities
  17. Ignite 2017: Interesting Windows Defender ATP Training Sessions
  18. Automated Response for Windows Defender ATP
  19. Windows Defender ATP Windows 10 Fall Creators Update now open for public preview
  20. What’s new in the WDATP Portal? July 4th 2017
  21. What’s new in the WDATP Portal? June 6th 2017
  22. What's new in the WDATP Portal? May 25th 2017
  23. What's new in the WDATP Portal? May 16th 2017
  24. What's new in the WDATP Portal? May 11th 2017
  25. What’s new in the WDATP Portal? April 19th 2017
  26. What's new in the WDATP Portal? March 23rd 2017