Memory scan for Linux
Analysis / inference: Microsoft Defender for Endpoint introduces a memory scan feature for Linux in preview to detect fileless threats and malicious code injection.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Endpoint - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft added a memory scan capability for Linux systems starting with Defender version 101.26071.0005 in the Insiders-slow channel, allowing inspection of process memory for malicious behaviors.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisMemory scanning on Linux closes a critical detection gap for sophisticated, fileless attacks and in-memory execution techniques that bypass traditional disk-based telemetry.
Provides SOC analysts with enhanced visibility into memory-resident malware and code injection techniques on Linux servers that leave no disk footprint.
Section 03 · Recommended actions
- Update Linux endpoints to version 101.26071.0005 or later
- Opt-in to the Insiders-slow channel to test memory scanning functionality
- Monitor Defender alerts for new memory-resident threat detections on Linux assets
- Verify the Defender for Endpoint version is 101.26071.0005 or later on Linux hosts
- Confirm hosts are enrolled in the Insiders-slow channel to receive the preview feature