Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Microsoft Defender is getting a useful upgrade to help stop endpoint attacks

Avast cybersecurity.

  • Microsoft is testing new features for Defender for Endpoint
  • The features will block traffic from and to undiscovered endpoints
  • The goal is to minimize malicious lateral movement

Microsoft wants to minimize the risk of undiscovered endpoints by adding a new feature to its Defender for Endpoint product, which will automatically block all traffic to and from such devices.

Such devices are a major security risk because they can bypass monitoring, lack security controls, and potentially serve as entry points for cyberattacks or data exfiltration.

The company is currently testing a new capability that will contain the IP addresses of devices that have not been discovered or onboarded to Defender for Endpoint.

Automatic protection

"Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through automatic attack disruption. The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded," Microsoft said.

"Through automatic attack disruption, Defender for Endpoint incriminates a malicious device, identifies the role of the device to apply a matching policy to automatically contain a critical asset. The granular containment is done by blocking only specific ports and communication directions."

We do not know yet when the feature will be released for the users, but we do know that it will be available on Defender for Endpoint-onboarded devices running Windows 10, Windows 2012 R2, Windows 2016, and Windows Server 2019+.

Microsoft also explained that there is a way to stop the product from containing different IP addresses by restoring the connection. That can be done via the “Contain IP” menu in the “Action Center”, which will have an “Undo” button.

Via BleepingComputer

You might also like

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.