Tamper protection in audit mode for Microsoft Defender for Endpoint on Linux (Preview)

Tamper protection in audit mode for Microsoft Defender for Endpoint on Linux detects unauthorized modifications to Defender for Endpoint assets, including configuration files, directories, processes, and services, even when changes are made by the root user.

Audit mode detects and alerts on the following tampering activities:

• Modification of Defender for Endpoint configuration files.
• Deletion of Defender for Endpoint configuration files, state files, and binaries.
• Renaming or moving Defender for Endpoint configuration files, state files, and binaries.
• Termination of Defender for Endpoint processes, including restarting Defender for Endpoint services.

Audit mode provides visibility into tampering attempts through alerts and Advanced Hunting in the Microsoft Defender portal without blocking the activity.

Prerequisites

Before you use tamper protection in audit mode, make sure your device meets the following requirements:

• Defender for Endpoint version 101.26072.0004 or later from the Insiders-Slow ring.
• Allow access to https://config.edge.skype.com/config/v1. For more information, see Microsoft Defender for Endpoint streamlined connectivity URLs - commercial.
• Use a supported Linux distribution and kernel version.

Tamper protection support is limited to kernel versions that support extended Berkeley Packet Filter (eBPF) with BPF Type Format (BTF). BTF provides enhanced event enrichment that enables Defender for Endpoint to capture the file and process context required to detect tampering attempts.

Enable tamper protection in audit mode

During preview, tamper protection in audit mode is enabled by default. No manual configuration is required.

The feature rolls out gradually over two weeks to eligible devices in the Insiders-Slow ring that meet the prerequisites.

After audit mode is enabled, the tamper_protection_enforcement_level field is available in the mdatp health output.

Verify audit mode enablement

To verify that tamper protection is enabled in audit mode:

1. Run the following command:

   mdatp health
   

2. Locate tamper_protection_enforcement_level in the output.

3. Verify that the value is set to audit:

   tamper_protection_enforcement_level : "audit"
   

4. Alternatively, run the following command to check the tamper protection status:

   mdatp health --details tamper_protection
   

   tamper_protection_enforcement_level : "audit"
   tamper_protection_errors            : []
   

   If tamper_protection_errors is empty, tamper protection is successfully enabled in audit mode.

   If tamper protection can't be enabled, tamper_protection_enforcement_level is displayed as disabled.

   The following errors can indicate why audit mode isn't enabled:

   Error	Description
   tamper_protection_unsupported_kernel_version	The device kernel version doesn't support tamper protection.
   not_supported_in_the_current_configuration	Tamper protection can't be enabled because a required internal configuration isn't available.

Troubleshoot audit mode enablement

If the device meets the prerequisites but tamper_protection_enforcement_level is set to disabled:

1. Run the following command:

   mdatp health --details cloud
   

2. Locate ecs_configuration_version in the output.

3. Check whether the value is unavailable:

   ecs_configuration_version : unavailable
   

   If the value is unavailable, verify that https://config.edge.skype.com/config/v1 is allowlisted. For more information, see Microsoft Defender for Endpoint streamlined connectivity URLs - commercial.

View tampering alerts in the Microsoft Defender portal

On the device page in the Microsoft Defender portal, tampering alerts are available in Timeline and Incidents and alerts.

Open a tampering alert to review more information about the activity, including the process tree and alert timeline.

Query tampering attempts with Advanced Hunting

You can use Advanced Hunting to investigate tampering events and alerts.

Query tampering events for a device

To query tampering attempts for a specific device:

1. Sign in to the Microsoft Defender portal.

2. Select Hunting > Advanced hunting.

3. Find the ID of the device you want to investigate in the device inventory, or run the following command on the device:

   mdatp health --field edr_device_id
   

4. Run the following query, replacing <DeviceId> with the device ID:

   DeviceEvents
   | where Timestamp > ago(10d)
   | where ActionType == "TamperingAttempt"
   | where DeviceId == "<DeviceId>"
   

   Adjust the Timestamp value in the query as needed.

Query tampering alerts

To query generated tampering alerts:

1. Sign in to the Microsoft Defender portal.

2. Select Hunting > Advanced hunting.

3. Run the following query:

   AlertInfo
   | where Timestamp > ago(10d)
   | where Title == "Tampering with the Microsoft Defender for Endpoint sensor"
   | where DetectionSource == "EDR"
   

   Adjust the Timestamp value in the query as needed.

Test a tampering scenario

You can generate a test tampering attempt to verify that audit mode detects the activity.

For example, run the following command:

sudo vim /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

The activity generates a tampering alert in the Microsoft Defender portal. The alert includes information about the initiating process and the target file.

Tune alerts for legitimate tampering activity

If known and approved activity generates tampering alerts, you can tune the alerts to reduce unnecessary noise in the Microsoft Defender portal.

For more information about creating alert tuning rules, see Tune an alert.

Related content

• Microsoft Defender for Endpoint on Linux
• Configure security policies and settings for Microsoft Defender for Endpoint on Linux
• Configure eBPF-based sensor for Microsoft Defender for Endpoint on Linux
• Investigate alerts in Microsoft Defender XDR