Microsoft Defender XDR: InitiatingProcessFolderPath changes to include file names
Microsoft Defender for Endpoint plans to update the InitiatingProcessFolderPath, which will now include file names, in all tables, affecting Windows activity. The change, which takes effect on November 4, 2024, will impact custom detection rules and queries. Previously, the InitiatingProcessFolderPath column was inconsistent across action types, but after the update, all action types across all tables will report the full path, including the file name of the initiating process. This change is on by default and requires admins to modify their custom detection rules and queries before the rollout date. Message ID: MC906487.
For more information, visit the post on M365 Admin.
Published on:
Learn moreWe can help you with Microsoft Defender XDR: InitiatingProcessFolderPath changes to include file names
If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.
Related posts
Threat Protection report page retirement
Microsoft has announced the retirement of the Threat Protection report page that is accessed through Reports > Endpoints > Threat Protection. ...
Microsoft Defender for Endpoint Tamper Protection
In this podcast episode, Josh Bregman talks about an essential feature of Microsoft Defender for Endpoint called Tamper Protection. Tamper Pro...
Advanced Threat Hunting with Microsoft 365 Defender
In this podcast episode, Michael and Michael dive into the world of advanced threat hunting using Microsoft 365 Defender. Joining the conversa...
RSA news: What's new in Defender XDR?
Microsoft Defender XDR keeps on innovating to fight against ever-changing cyber threats which have the potential to cripple organizations. The...
Data Loss Prevention – Out-of-box Advanced Hunting queries for Data Loss Prevention incidents in Microsoft 365 Defender
This post provides information about how to use out-of-box advanced hunting queries for Data Loss Prevention incidents in Microsoft 365 Defend...
Easily detect CVE-2024-21427 with Microsoft Defender for Identity
A recent CVE-2024-21427 Windows Kerberos Security Feature Bypass Vulnerability has been fixed to prevent the potential bypass of authenticatio...
Configuration Change – Microsoft Defender for Cloud Apps threat protection policies
Microsoft is making changes to the default threat protection policies for Microsoft Defender for Cloud Apps. These policies will now be disabl...
Host Microsoft Defender data locally in Switzerland
Microsoft Defender for Endpoint and Microsoft Defender for Identity customers in Switzerland can now benefit from local data residency support...
Network Protection for macOS starting deployment to General Availability on 1/31!
Microsoft Defender for Endpoint has good news for its macOS users. The Network Protection feature for macOS will soon be available to all the ...
Microsoft OneNote : improved protection against known high risk phishing file types
Microsoft OneNote has stepped up its security game with improved protection against known high-risk phishing file types. This upgrade will not...