Identification

ATP

To detect if Windows ATP is running on the machine:

Process

MsSense.exe

Service

PS C:\> Get-Service Sense
C:\> sc query sense

Display Name: Windows Defender Advanced Threat Protection Service

Name: Sense

Registry

HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

File Paths

C:\Program Files\Windows Defender Advanced Threat Protection\

ASR Rules are stored here:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager\

To check if certain rules are enabled or not:

0 = Off
1 = Block
2 = Audit

ATA

Check for ATA admins:

Get-CimInstance -ClassName Win32_Group -Filter "Domain = 'dev' AND Name='Microsoft Advanced Threat Analytics Administrator'" | Get-CimAssociatedInstance -Association Win32_GroupUser

PreviousDomain Dominance NextRecon

Last updated 3 years ago