I’ve now been working in tech for 25 years, and in that time I’ve developed some wisdom. One theme I’ve discovered and blogged about repeatedly over the years is profound despite its simplicity: In many cases, the best way to know whether something will work is to just try it. I’ve written numerous posts makingContinue reading “Experimentation: Just Try It!”
Tag Archives: Defender
The Windows Security App
Going back as far as the 2004 release of Windows XP SP2, Windows has offered various GUIs to help users understand the security state of their PC. In modern Windows 10 (RS2+) and Windows 11, the latest version of this graphical user interface is called the “Windows Security Center/App“. The Windows Security App (WSA) isContinue reading “The Windows Security App”
Offboarding from Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is a paid security product that extends Microsoft Defender Antivirus (included for free in Windows) with enterprise capabilities, including a full EDR product that reports security telemetry into a security operations center (SOC). Some recently-retired Microsoft employees have been surprised to discover that their personal PCs that had previously been usedContinue reading “Offboarding from Microsoft Defender for Endpoint”
Participatory Extensible Security
In the past, I’ve explained how security products combine sensors and throttles with threat intelligence to protect users and devices from attack. I’ve also outlined how the evolution of software, including increased complexity and a focus on privacy, have made it harder than ever for sensors and throttles to function effectively, leading to security andContinue reading “Participatory Extensible Security”
Exploiting Vulnerable Drivers
Often, attackers will attempt to prevent security software from interfering with their attack chains by abusing a vulnerable driver to kill or otherwise disable the system’s security software (antivirus/edr/etc). Because drivers run in highly-privileged OS Kernel mode, it is difficult to prevent attackers from achieving their goals if they manage to achieve code execution inContinue reading “Exploiting Vulnerable Drivers”