Microsoft Defender is getting a useful upgrade to help stop endpoint attacks

• Microsoft is testing new features for Defender for Endpoint
• The features will block traffic from and to undiscovered endpoints
• The goal is to minimize malicious lateral movement

Microsoft wants to minimize the risk of undiscovered endpoints by adding a new feature to its Defender for Endpoint product, which will automatically block all traffic to and from such devices.

Such devices are a major security risk because they can bypass monitoring, lack security controls, and potentially serve as entry points for cyberattacks or data exfiltration.

The company is currently testing a new capability that will contain the IP addresses of devices that have not been discovered or onboarded to Defender for Endpoint.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

Automatic protection

"Containing an IP address associated with undiscovered devices or devices not onboarded to Defender for Endpoint is done automatically through automatic attack disruption. The Contain IP policy automatically blocks a malicious IP address when Defender for Endpoint detects the IP address to be associated with an undiscovered device or a device not onboarded," Microsoft said.

"Through automatic attack disruption, Defender for Endpoint incriminates a malicious device, identifies the role of the device to apply a matching policy to automatically contain a critical asset. The granular containment is done by blocking only specific ports and communication directions."

We do not know yet when the feature will be released for the users, but we do know that it will be available on Defender for Endpoint-onboarded devices running Windows 10, Windows 2012 R2, Windows 2016, and Windows Server 2019+.

Microsoft also explained that there is a way to stop the product from containing different IP addresses by restoring the connection. That can be done via the “Contain IP” menu in the “Action Center”, which will have an “Undo” button.

Via BleepingComputer

You might also like

• Microsoft Defender will now warn users about insecure Wi-Fi networks
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers