Attack detection – Endpoint Detection and Response
Another really important point is to have a product in place to detect attacks and react to them. There are many great products out there that can help you with this task. Make sure that the product of your choice also supports PowerShell and helps you detect suspicious commands that were launched via PowerShell and other command-line tools.
Microsoft’s solution, for example, is called Microsoft Defender for Endpoint. But other vendors provide similar solutions.
Enabling free features from Microsoft Defender for Endpoint
Even if you do not use Microsoft Defender for Endpoint, various features are free to use without any subscription:
- Hardware-based isolation/Application Guard
- Attack surface reduction rules
- Controlled folder access
- Removable storage protection
- Network protection
- Exploit Guard
- Windows Defender Firewall with advanced security
Many of these features can even...
