Mike Manrod·Aug 17, 2025A Few Reflections on the Problem of Malicious Agents, EDR Shortcomings, and Lack of App Control…by Ezra Woods and Mike Manrod
HotCakeX·Jul 23, 2023Create and Deploy Signed WDAC Windows Defender PolicyBy deploying a Signed Windows Defender Application Control policy, a system will be secure and resistant to any form of tampering.
HotCakeX·Jul 23, 2023WDAC policy for BYOVD Kernel mode only protectionThis scenario involves removing the trust to any Kernel mode driver, whether they are vulnerable or not. It does not affect User-mode…
InFalconForcebyOlaf Hartong·Jul 8, 2022Microsoft Defender for Endpoint Internals 0x03 — MDE telemetry unreliability and log augmentationIn part one and part two of this series, we have established that Microsoft Defender for Endpoint (MDE) uses sampling and caps on events…A response icon1A response icon1
Matt Graeber·Jan 4, 2021Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure…The goal is to highlight the WDAC improvements made since Windows 10 20H2 in the context of building and applying a simple but secure…A response icon2A response icon2
Matt Graeber·Nov 5, 2020Windows Defender Application Control (WDAC) ResourcesOver the years, I have written and recorded a lot of material related to Windows Defender Application Control (previously, Device Guard)…A response icon1A response icon1
