- Microsoft is testing new features for Defender for Endpoint
- The features will block traffic from and to undiscovered endpoints
- The goal is to minimize malicious lateral movement
Microsoft wants to minimize the risk of undiscovered endpoints by adding a new feature to its Defender for Endpoint product, which will automatically block all traffic to and from such devices.
Such devices are a major security risk because they can bypass monitoring, lack security controls, and potentially serve as entry points for cyberattacks or data exfiltration.
The company is currently testing a new capability that will contain the IP addresses of devices that have not been discovered or onboarded to Defender for Endpoint.
Automatic protection
“Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through automatic attack disruption. The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded,” Microsoft said.
“Through automatic attack disruption, Defender for Endpoint incriminates a malicious device, identifies the role of the device to apply a matching policy to automatically contain a critical asset. The granular containment is done by blocking only specific ports and communication directions.”
We do not know yet when the feature will be released for the users, but we do know that it will be available on Defender for Endpoint-onboarded devices running Windows 10, Windows 2012 R2, Windows 2016, and Windows Server 2019+.
Microsoft also explained that there is a way to stop the product from containing different IP addresses by restoring the connection. That can be done via the “Contain IP” menu in the “Action Center”, which will have an “Undo” button.
Via BleepingComputer
Leave a comment