Linux | June 2026 | 101.26042.0011
Analysis / inference: Microsoft Defender for Endpoint on Linux version 101.26042.0011 fixes a post-reboot disablement bug and introduces original user tracking for sudo commands.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Endpoint releases · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Released MDE for Linux version 101.26042.0011, fixing an agent disablement bug, introducing original login user tracking for sudo actions, adding offline security intelligence updates, and expanding distribution support.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis release fixes a critical bug where Microsoft Defender for Endpoint on Linux could become disabled after upgrades or reinstalls followed by a reboot, while adding original user attribution for sudo actions in Advanced Hunting.
Improved hunting accuracy via original user attribution for privileged actions, alongside resolution of agent stability issues on Linux.
Section 03 · Recommended actions
- Upgrade MDE for Linux agents running builds 101.26042.0000 through 101.26042.0009 to version 101.26042.0011
- Review existing hunting queries for Linux sudo events to leverage the new user ID attribution fields
- Verify if your Linux endpoints are running MDE version 101.26042.0011 or later
- Check Advanced Hunting telemetry to confirm original login user IDs are populated for actions performed via sudo or root