ToggleGuardian: Windows Defender Close. | 亦极简的电脑管家，一键关闭 Microsoft Defender Anti-Virus。

Everything about Microsoft Cloud Security!

Advanced Interactive Security Workshop

Administrative Template (ADMX) for Microsoft Defender Attack Surface Reduction (ASR)

⛳️ PASS: Microsoft SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) by learning based on our Questions & Answers (Q&A) Practice Tests Exams.

Collection of scripts and importable settings for the Microsoft Suite aligned with my blog

KQL queries for Microsoft Defender Advanced Hunting organized around the TTPs of the MITRE ATT&CK framework.

Automated Migration from 3rd party AV to Microsoft Defender AV

Deploy Microsoft Defender Endpoint for Linux with Ansible

WindowsNinja - Unleash the Power of Windows System Information Gathering! 🖥️🕵️✨ Harness the capabilities of WindowsNinja to silently gather detailed information about your Windows system. Analyze your system's defenses, expose configurations. 🕵️‍♂️💻 Dive into the depths of your Windows environment with WindowsNinja.

权限提升、自我复制、强制结束系统进程

This Repository provides detection rule when Recommendation of Microsoft Defender for Cloud state was changed to "Unhealthy".

Microsoft related PowerShell scripts and KQL queries

Setting Up Wazuh SIEM/XDR Homelab and Integration of Microsoft Defender into it.

Simple KQL query that can be run either in MD for Endpoint (Threat hunting or Custom indicator) or in Azure Sentinel (Threat hunting or analytics rule).It's looking for 4 known IOCs related to the Kaseya attack

Azure Virtual Machine (VM) with Just-in-Time access

This article is about Microsoft Defender for Cloud Apps, exploring its functionalities and practical use cases to illuminate how it fortifies cloud security.

Microsoft Security Operations Analyst

Block File Hashes found in Microsoft Sentinel Incidents in Defender

This tool is a batch file to restore all quarantined items from the "Quarantine" folder of Microsoft Defender.