#defender

Happy to share I've joined the Microsoft Security Advisors Program :) Looking forward to giving Microsoft's engineering teams some real-world Blue Team feedback from the field. #MSSecurity #BlueTeam #Intune #Defender #Entra

Hoping someone can chime in, i'm at a wall at the moment. So, i've come across a scenario where i have a couple of users devices that are downloading crypto token icons in SVG format to a directory that is then deleted. From all of the evidence gathered, it look slike this is all happening within 30 seconds on the devices. We manage Chrome with policies. We have a whitelist for plugins and extensions. I located this, while searching for something else in our XDR logs. C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\arc-native-token-logo.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\avax-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura.svg We've manually checked the users device, installed extensions/plugins, we've used KQL queries to try to locate the root of this, however, the way Chrome works, it hides the information we're looking for. I've even gone through all the chrome://chrome-urls/ to see if i could locate anything. We've compared job roles, of the users and they have nothing in common. One of the new ones located had this information Process event: chrome.exe --utility-sub-type=unzip.mojom.Unzipper Time: 7:21:46 PM File events (10 SVGs): Time: 7:22:11 PM Folder:Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ Delta = ~25 seconds What is excluded in all of the logs on the device and in our Defender system, is if this is an extension, what the ID or name is if it is. I know or at least I know that the CRX also handles Chrome updates. But in either case, I need to find out what is download icons for crypto currency then deleting it. The users event viewer shows nothing, as these events are not logged, so I am hoping someone might know a way to dig deeper into Chrome to figure this out. This is the Initiating Process Command Line for just about everyone of these entries "chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --metrics-shmem-handle=5840,i,2169236920772237475,2071396139152657378,524288 --field-trial-handle=1940,i,9109780936433903204,1179441795768105101,262144 --variations-seed-version=20260630-171645.651000-production --pseudonymization-salt-handle=1956,i,16028727218760239160,14674054428472284321,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5868 /prefetch:14 #Chrome #KQL #Defender

Hedonic Is Keeping the Classic Defender 90 Soft-Top Alive with This Gorgeous Beach Cruiser https://hiconsumption.com/motors/2026-hedonic-land-rover-defender-90-soft-top-custom/?utm_source=flipboard&utm_content=Econopass%2Fmagazine%2FFLIPBOARD+EXCHANGE+FEED+%F0%9F%97%9E%EF%B8%8F Ever since the Land Rover Defender 90 was initially discontinued a decade ago (and subsequently brought back slightly different in 2020), restomod … #cars #defender #beachcruiser

We have pledged allegiance to defend him. He is the Imam of both communities. May Allah bless him and his companions. #Defender موږ یې ددین دفاع ته سر ايښی دی . هغه د دواړو جهانونو امام😘 صلی الله علیه واله واصحابه اجمعین . #فدا Source: Ⓜ️abdulhaq. عبدالحق فدا (@Abdulhaqfida111) [ https://x.com/Abdulhaqfida111/status/2027027971668574439 ] #Afghanistan