01 | Security
On is not the same as covering
Microsoft Threat Intelligence describes a campaign distributing malware through counterfeit vendor download pages. The installer adds Defender exclusion paths, deletes shadow copies and disables Windows Update, and the download is rebuilt for every request so the hash changes each time. Microsoft’s mitigation is to enforce tamper protection. The documentation adds that exclusions are covered only if four conditions all hold, and a co-managed device is listed as not supported.
Owner: Whoever owns endpoint security, with whoever can say how each device is managed
Seven day action: read TPExclusions under Windows Defender, Features on a sample of devices; 1 means exclusions are protected, 0 means they are not, whatever the dashboard says.
Retain: the dated readings with the device management model that explains them, the tamper protection assignment, and the Defender exclusion list in force at the time.
Read the Braintree analysis
- 01Read
- 02Explain
- 03Keep
02 | Cost
Reversible describes the setting, not the data
Two Azure Monitor capabilities reached general availability. The cheap Auxiliary log plan now accepts standard Azure tables, and an existing table can be moved onto it in place, keeping its name, schema and queries. Microsoft calls the switch fully reversible. The documentation records that alerts stop working on a table moved to Auxiliary, that plan changes are limited to one per table per week, and that data written on the cheap plan is not in your normal queries after you switch back.
Owner: Whoever owns the Azure Monitor bill, jointly with whoever owns alerting
Seven day action: pick the noisiest tables you pay for, then list every alert rule and summary rule reading them before a single plan changes, not after.
Retain: the table plans as they stand today, every alert rule bound to them, the date of each change, and the window where data is reachable only by a search job.
Read the Braintree analysis
- 01Pick
- 02List
- 03Keep
03 | Networking
A toggle that costs a maintenance window
Azure Firewall auto-learn SNAT routes reached general availability. The firewall learns internal address ranges every thirty minutes and stops rewriting the source address on traffic to them, so original source addresses survive to the far side. The prerequisite is an Azure Route Server in the same virtual network, and Microsoft states that creating one where a VPN or ExpressRoute gateway already lives takes that gateway down for around ten minutes.
Owner: The network lead who owns the hub virtual network, with the change manager
Seven day action: look at what else lives in the firewall’s virtual network; if a gateway is there, this is a change window and Microsoft recommend booking sixty minutes.
Retain: the SNAT private ranges before the change, what else occupies that network, the approved window against the observed downtime, and the learned prefix list after.
Read the Braintree analysis
- 01Look
- 02Book
- 03Verify
