Compromised Account

[Trevor Chandler]

Hello CINners,

What tool, or technique(s), do you use to detect a compromised
user account? A tool, indigenous in the operating system,
would be nice, if one exist. I'm always looking to save a buck!!!

Thanks CINners

 

[Rick Butler]

Hello CINners,

What tool, or technique(s), do you use to detect a compromised
user account? A tool, indigenous in the operating system,
would be nice, if one exist. I'm always looking to save a buck!!!

Thanks CINners

This is another reason why I like Defender 365 - because it will send out Users at Risk notifications. Defender also allows you to review audits of user accounts for unusual activity. Upgrading to Defender XDR will add SIEM and SOAR capability to the Defender console.

/r

 

[precious]

Event Viewer in Windows.
*nix system - fail2ban or simply checking /var/log

 

[Trevor Chandler]

This is another reason why I like Defender 365 - because it will send out Users at Risk notifications. Defender also allows you to review audits of user accounts for unusual activity. Upgrading to Defender XDR will add SIEM and SOAR capability to the Defender console.

/r

I like the sound of what this Defender 365 app provides!
Does Defender 365 come with Windows 10?

That upgrading to Defender XDR sounds like I might have to dig into
my meager, shallow, pockets. Would I be correct in assuming that to
be the case??????

 

[Rick Butler]

I like the sound of what this Defender 365 app provides!
Does Defender 365 come with Windows 10?

That upgrading to Defender XDR sounds like I might have to dig into
my meager, shallow, pockets. Would I be correct in assuming that to
be the case??????

Windows 10 does ship with Windows Defender, but Defender 365 is Cloud based software. Now, if you have the licensing for Defender 365 (P1 or P2), windows 10 will adapt and connect to it if the machine connects to Azure through MDM/Intune.

Defender XDR does have its own licensing. and it is not very cheap. It's more tilted for organizations that have some deep pockets.

 

[Trevor Chandler]

Windows 10 does ship with Windows Defender, but Defender 365 is Cloud based software. Now, if you have the licensing for Defender 365 (P1 or P2), windows 10 will adapt and connect to it if the machine connects to Azure through MDM/Intune.

Defender XDR does have its own licensing. and it is not very cheap. It's more tilted for organizations that have some deep pockets.

If I have the licensing for Defender 365? My use of Windows 10 is for the home! There's a financial cost associated with licenses! Need I go any further (or is it farther) with this!!!

Is Windows Defender, alone, enough to assist me with detecting a compromised account?

 

[Rick Butler]

If you're doing this at home, I don't think you can do much more than Defender that comes with the PC. Didn't realize we were dealing with Home systems. In this case, you'll probably want to have a look at this: https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals. Do you have a Microsoft 365 Personal/Individual subscription?

 

[Trevor Chandler]

If you're doing this at home, I don't think you can do much more than Defender that comes with the PC. Didn't realize we were dealing with Home systems. In this case, you'll probably want to have a look at this: https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals. Do you have a Microsoft 365 Personal/Individual subscription?

I do not have a Microsoft 365 Personal/Individual subscription. Is there a financial cost associated with this?

 

[Rick Butler]

Yup. $70/yr for an individual, $100/yr for a family up to six.

 

[Trevor Chandler]

Yup. $70/yr for an individual, $100/yr for a family up to six.

Thanks for that information. Now I've got a reference point to work from!!!