Monthly news - March 2024

(Generally available) Dark mode is now available in the Microsoft Defender portal. In the Defender portal, on the top right-hand side of the homepage, select Dark mode. Select Light mode to change the color mode back to the default. 

(Generally available) Assigning severity to incidents, assigning an incident to a group, and the go hunt option from the attack story graph are now generally available. Guides to learn how to assign or change incident severity and assign an incident to a group are in the Manage incidents page. Learn how you can use the go hunt option by exploring attack story.

(Preview) Custom detection rules in Microsoft Graph security API are now available. Create advanced hunting custom detection rules specific to your org to proactively monitor for threats and take action.

Hunting for QR Code AiTM Phishing and User Compromise. This blog explains the mechanics of QR code phishing, and details how Defender Experts hunt for these phishing campaigns. Additionally, it outlines the procedures in place to notify customers about the unfolding attack narrative and its potential ramifications.

• Block rebooting machine in Safe Mode (preview): This rule prevents the execution of commands to restart machines in Safe Mode.
• Block use of copied or impersonated system tools (preview): This rule blocks the use of executable files that are identified as copies of Windows system tools. These files are either duplicates or impostors of the original system tools.

We published a new Mechanics Video showcasing our ITDR platform. In this video Daniel Lynch, Microsoft Defender for Identity’s Senior Product Manager, shares how Identity Threat Detection and Response can be utilized in daily operations and coordinated actions throughout every phase of an identity-related security incident, strengthening your organization's defense posture. 

Defender for Identity daily, weekly, monthly operations guide. We just published a new docs page to guide you through common operational tasks. 

New App governance alerts for Credential Access and Lateral Movement. 

We've added the following new alerts for App governance customers:

• Application initiating multiple failed KeyVault read activity with no success
• Dormant OAuth App predominantly using MS Graph or Exchange Web Services recently seen to be accessing ARM workloads

For more information, see App governance in Defender for Cloud Apps.

Defender for Cloud Apps has now enhanced its SSPM support in general availability by including the following apps:

• Atlassian
• Dropbox
• Zendesk

SSPM is also now supported for Google Workspace in General Availability.

Updates to Configuration Analyzer in Defender for Office 365. We are excited to announce several updates to Configuration analyzer - read this blog post to learn more about these updates. 

Recently these videos have been posted on YouTube:

• Operationalize new response capabilities for SecOps using Defender for Office 365
• Defense in depth in dual-use configuration using Defender for Office 365
• Get to optimal configuration and design phish simulation training using Defender for Office 365
• Harness the power of Microsoft Defender when triaging and responding to user reported Phish

We recently published the Defender Vulnerability Management Ninja Training! Have a look, take the knowledge check and grab your fun certificate.