Cyber Security Defense with Microsoft Defender.

Acknowledgments
	From Dave
About the Authors
	Dave Kawula – Microsoft MVP
		Cristal Kawula – Microsoft MVP
		Emile Cabot – Microsoft MVP
		Cary Sun – Microsoft MVP
		John O’Neill Sr – Re-Connect Microsoft MVP
Introduction: MVPDays Online
	Sample Files
		Additional Resources
Chapter 1: Setting up your Azure Subscription from Scratch
Chapter 2: Configuring Windows Admin Center and Azure Arc
	2.1 Configure Windows Admin Center
		2.2 Configure Azure Integration
		2.3 Setup Azure Arc
		2.4 Configure Azure Updates
		2.5 Azure Backup
		2.6 Verify Backup Jobs with Azure Backup
		2.7 Onboard Servers to Azure Security Center
		2.8 Configure Azure Site Recovery
		2.9 Configure Vulnerability Management with Microsoft Defender via Azure Arc
Chapter 3: Microsoft Defender for Cloud
	3.1 Enabling Microsoft Defender for Cloud on Azure Resources and Azure Arc Resource
Chapter 4: Microsoft Defender Advanced Threat Protection ATP
	4.1 Onboarding a Desktop with Microsoft Defender ATP
		4.2 Reviewing an Incident with Microsoft Defender Advanced Threat Protection
Chapter 5: Simulating a Ransomware Attack on Windows 10
	5.1 Running KnowBe4 Ransomware Simulator on Windows 10 no Security Baselines
		5.2 Locking Down older systems with Group Policy Security Baselines and Security Compliance Manager 4.0
		5.3 Locking Down Windows Server 2019/2022 and Windows 10/11 with Group Policy Security Baselines via Security Compliance Toolkit 1.0
		5.4 Running KnowBe4 Ransomware Simulator on Windows 10 with Security Baselines
		5.2 Enabling Ransomware Protection on Windows 10
		5.3 – Controlled Folder Access vs. Ransomware Attack with PowerShell
		5.3 – No Controlled Folder Access vs. Ransomware Attack with PowerShell
Chapter 6: Attack Simulation – Document Drops Back Door
	6.1 – Document Back Door Drop vs. Microsoft Defender ATP
Chapter 7: Attack Simulation – PowerShell Fileless Attack
	7.1 – PowerShell fileless attack (Process Hollowing Attack) no Exploit Guard
		7.2 – Enable Exploit Protection
		7.3 – PowerShell fileless attack (Process Hollowing Attack) with Exploit Guard
Chapter 8: Attack Simulation – Live Response
	8.1 – Live Response in Microsoft Defender Security Center
Chapter 9: Attack Remediation – Chat with Threat Experts at Microsoft
	9.1 – Apply to the Microsoft Threat Experts Program
Chapter 10: Recovering from Ransomware using Azure Site Recovery
	Notes from the Field
		Why Airgapped Replicas are the only choice
		Why Planned Failover is no longer an option
		Failover Now is the only Option
		Watch you Six (Clock)
		Do not connect your Azure Site Recovery Virtual Machines to a live Site-to-Site VPN
		When can I get back into my data?
		Ok, so I didn’t listen and lost everything. Now what?
		Don’t forget to tune your Replication Policy
		Testing Failover can be a quick Ransomware Fix
		Reset Settings for your Azure Site Recovery Hyper-V Host
		Enable Diagnostic Logging for Azure Site Recovery
	Zero Day time to Failover
		Assuming an Admin Level breach Failing over 100 % to Azure
		10.1 Executing a PowerShell-based Ransomware Attack on Domain Controllers.
		10.2 Taking Down Production by Killing Domain Controllers with Ransomware
		10.3 Survival Mode Recovering to Azure
		Tick Tock time to make a decision – We are Recovering to Azure
		10.4 Performing the Double Swing Recovery
Chapter 11: Microsoft Defender 365
	11.1 A lap around Microsoft 365 Defender Portal
Chapter 12: Join us at MVPDays and meet great MVP’s like this in person
	Live Presentations
	Video Training
	Live Instructor-led Classes
	Consulting Services