Microsoft Defender for Endpoint
Endpoint protectionAmsi On Mdav
In brief
The AMSI on Microsoft Defender Antivirus article now points to the updated App Control for Business and AppLocker overview path.
What Defender admins need to know
Administrators following the reference will reach the current overview page. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
More resources to protect against fileless attacks
Windows Defender Application Control and AppLockerWindows Defender Application Control and AppLocker. Enforces strong code Integrity policies and to allow only trusted applications to run. In the context of fileless malware, WDAC locks down PowerShell to Constrained Language Mode, which limits the extended language features that can lead to unverifiable code execution, such as direct .NET scripting, invocation of Win32 APIs via the Add-Type cmdlet, and interaction with COM objects. This essentially mitigates PowerShell-based reflective DLL injection attacks. If WDAC script enforcement is enabled and you need Defender for Endpoint PowerShell scripts to run in FullLanguage mode, see Allow Defender for Endpoint scripts with WDAC script enforcement.Attack surface reduction helps admins protect against common attack vectors.
@@ -98,7 +98,7 @@ integration. ## More resources to protect against fileless attacks -- [Windows Defender Application Control and AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview). Enforces strong code Integrity policies and to allow only trusted applications to run. In the context of fileless malware, WDAC locks down PowerShell to Constrained Language Mode, which limits the extended language features that can lead to unverifiable code execution, such as direct .NET scripting, invocation of Win32 APIs via the Add-Type cmdlet, and interaction with COM objects. This essentially mitigates PowerShell-based reflective DLL injection attacks. If WDAC script enforcement is enabled and you need Defender for Endpoint PowerShell scripts to run in FullLanguage mode, see [Allow Defender for Endpoint scripts with WDAC script enforcement](configure-wdac-script-enforcement-mde.md).+- [Windows Defender Application Control and AppLocker](/windows/security/application-security/application-control/app-control-for-business/appcontrol-and-applocker-overview). Enforces strong code Integrity policies and to allow only trusted applications to run. In the context of fileless malware, WDAC locks down PowerShell to Constrained Language Mode, which limits the extended language features that can lead to unverifiable code execution, such as direct .NET scripting, invocation of Win32 APIs via the Add-Type cmdlet, and interaction with COM objects. This essentially mitigates PowerShell-based reflective DLL injection attacks. If WDAC script enforcement is enabled and you need Defender for Endpoint PowerShell scripts to run in FullLanguage mode, see [Allow Defender for Endpoint scripts with WDAC script enforcement](configure-wdac-script-enforcement-mde.md). - [Attack surface reduction](attack-surface-reduction-overview.md) helps admins protect against common attack vectors.