Jeffrey Appel walks through the network protection C2 detection in Microsoft Defender for Endpoint, which inspects outbound traffic, blocks connections to known command-and-control infrastructure and has Defender Antivirus remediate the process behind them.
Microsoft’s announcement from November 2022 explains where the verdicts come from (a reputation database of C2 IPs, domains and URLs plus machine learning models retrained daily) and notes that the Cobalt Strike C2 domain in one LockBit intrusion had been flagged two weeks before the attack.
Per Appel, C2 detection needs Defender Antivirus in active mode with real-time and cloud-delivered protection, network protection in block mode and engine 1.1.17300.4 or later, and servers need extra configuration before any of it switches on.
Appel’s post covers testing against Microsoft’s SmartScreen demo endpoint and hunting with the ConnectionInspected events in DeviceNetworkEvents.
Worth checking whether your fleet actually meets those prerequisites before you assume the beacons are being dropped.
If it doesn’t, Fabian Bader’s approach of matching DeviceNetworkEvents against the Feodo Tracker blocklist in a custom detection rule at least gets you alerts and automated response actions.
