What Changed
Microsoft has added automatic device isolation to Defender’s attack disruption feature. Until now, attack disruption mainly contained compromised user identities. The new action cuts an endpoint off from the network when Defender reaches a high-confidence verdict that it is compromised. Microsoft says it holds that threshold at 99% precision.
The QNET Case
Microsoft illustrates the feature with an incident at QNET. A malicious file launched mshta.exe to fetch a second-stage payload, with registry persistence activity (RunMRU) alongside. Defender detected the activity at 09:23:20 UTC, started the IsolateDevice action at 09:25:16 and completed it at 09:25:28: 128 seconds in total.
Microsoft reports that the second stage never arrived and there was no lateral movement. The post includes a comment from Ben Bredenkamp, Group CIO of QI Group, and maps the activity to ATT&CK techniques T1204.002, T1218.005, T1071.001 and T1112.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
Containing a compromised identity does not stop a payload already running on a laptop. Device isolation addresses that gap, at the cost of taking a user offline automatically.
According to Microsoft, automatic isolation currently applies to onboarded Defender for Endpoint workstations and is time-limited.
What To Verify First
- Confirm whether attack disruption is enabled in your Defender XDR tenant and which actions it may take.
- Decide which business-critical services should stay reachable during isolation.
- Make sure the SOC and help desk know how to handle a user whose device was isolated automatically.
- Review detections for living-off-the-land tools such as
mshta.exe.
What Teams May Be Underestimating
This is a vendor case study, so it shows a best case. The useful lesson is about timing: an attack that a human contains in 20 minutes may already have spread, while one contained in two minutes often has not.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
