From b3f65549b8a03795c6119989a449c423e01004fe Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Fri, 27 Dec 2019 15:41:37 +0200 Subject: [PATCH 01/51] add note about Office requirement https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5632 --- .../threat-protection/microsoft-defender-atp/evaluation-lab.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index c7ae3aac79..c57aaa4f25 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -130,6 +130,9 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query >[!NOTE] >The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. +>[!NOTE] +>Microsoft Office needs to be installed on the test machines for all the simulations to work. + 1. Connect to your machine and run an attack simulation by selecting **Connect**. ![Image of the connect button for test machines](images/test-machine-table.png) From 99465074cfc870e6c68d49a01359dfb10a5889e7 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 31 Dec 2019 10:29:56 +0200 Subject: [PATCH 02/51] Update windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/microsoft-defender-atp/evaluation-lab.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index c57aaa4f25..7c12abf5ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -127,7 +127,7 @@ If you are looking for a pre-made simulation, you can use our ["Do It Yourself" You can also use [Advanced hunting](advanced-hunting-query-language.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats. ->[!NOTE] +> [!NOTE] >The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. >[!NOTE] @@ -182,4 +182,3 @@ Your feedback helps us get better in protecting your environment from advanced a Let us know what you think, by selecting **Provide feedback**. ![Image of provide feedback](images/send-us-feedback-eval-lab.png) - From 8223224f467e69c9af6f4c362535f29c6faabe07 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 31 Dec 2019 10:30:02 +0200 Subject: [PATCH 03/51] Update windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/microsoft-defender-atp/evaluation-lab.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index 7c12abf5ca..e72267221c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -128,7 +128,7 @@ If you are looking for a pre-made simulation, you can use our ["Do It Yourself" You can also use [Advanced hunting](advanced-hunting-query-language.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats. > [!NOTE] ->The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. +> The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. >[!NOTE] >Microsoft Office needs to be installed on the test machines for all the simulations to work. From 26c6318fe1c01bf7a2e9f849990e89b38d410f5c Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 31 Dec 2019 10:30:07 +0200 Subject: [PATCH 04/51] Update windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/microsoft-defender-atp/evaluation-lab.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index e72267221c..243b2fe6a5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -130,7 +130,7 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query > [!NOTE] > The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. ->[!NOTE] +> [!NOTE] >Microsoft Office needs to be installed on the test machines for all the simulations to work. 1. Connect to your machine and run an attack simulation by selecting **Connect**. From 3468922d71fa68b13657fb729a2c37e4866fecf1 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 31 Dec 2019 10:30:13 +0200 Subject: [PATCH 05/51] Update windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/microsoft-defender-atp/evaluation-lab.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index 243b2fe6a5..925e7e0ce3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -131,7 +131,7 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query > The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. > [!NOTE] ->Microsoft Office needs to be installed on the test machines for all the simulations to work. +> Microsoft Office needs to be installed on the test machines for all the simulations to work. 1. Connect to your machine and run an attack simulation by selecting **Connect**. From c6d57cb3d14babe7249af004bec1af419728d7d5 Mon Sep 17 00:00:00 2001 From: isbrahm <43386070+isbrahm@users.noreply.github.com> Date: Tue, 7 Jan 2020 15:21:52 -0800 Subject: [PATCH 06/51] Update recommended block list to explain not blocking 1903 files msxml3.dll, msxml6.dll, and jscript9.dll do not have to be blocked if using 1903, as the previous issue was fixed in this release --- .../microsoft-recommended-block-rules.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index fc2d28a1c6..044f402da2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -160,9 +160,8 @@ Pick the correct version of each .dll for the Windows release you plan to suppor - - - + + +