Microsoft Details How Defender Protects High-Value Assets in Real-World Attacks

Microsoft Defender has been enhanced with Security Exposure Management to provide context-aware protection for High-Value Assets (HVAs) such as domain controllers and internet-facing servers. The update describes automated asset classification, baseline learning, and targeted detections that can block actions like NTDS database extraction and customized IIS webshells, as well as monitoring identity infrastructure to prevent credential exfiltration.