Attack detection – Endpoint Detection and Response
Another really important point is to have a product in place to detect attacks and react to them. There are many great products out there that can help you with this task. Make sure that the product of your choice also supports PowerShell and helps you detect suspicious commands that were launched via PowerShell and other command-line tools.
Microsoft’s solution, for example, is called Microsoft Defender for Endpoint. But other vendors provide similar solutions.
Enabling free features from Microsoft Defender for Endpoint
Even if you do not use Microsoft Defender for Endpoint, various features are free to use without any subscription:
