Ransomware remains the most impactful threat to NZ SMBs. Here's how Defender for Business is configured to detect, contain, and remediate ransomware — and where the MSP's role is critical.
Key takeaways
- 1Behavioural detection — file enumeration, shadow copy deletion, and rapid file modification patterns trigger alerts before encryption completes
- 2Controlled folder access — protects common file locations (Documents, Pictures, Desktop) from unauthorised modification by unknown processes
- 3Attack Surface Reduction rules — blocks techniques commonly used in the pre-encryption phase of ransomware attacks
- 4Network protection — blocks connections to known malicious domains used for command-and-control
- 5Automated investigation — when ransomware behaviour is detected, Defender automatically isolates the affected device and begins remediation
Ransomware attacks cost New Zealand businesses millions of dollars annually. The threat has evolved from automated attacks targeting weak RDP passwords to sophisticated hands-on-keyboard attacks using legitimate tools to move laterally before deploying encryption. Defender for Business is configured to detect and respond to both.
How Defender for Business detects ransomware
- Behavioural detection — file enumeration, shadow copy deletion, and rapid file modification patterns trigger alerts before encryption completes
- Controlled folder access — protects common file locations (Documents, Pictures, Desktop) from unauthorised modification by unknown processes
- Attack Surface Reduction rules — blocks techniques commonly used in the pre-encryption phase of ransomware attacks
- Network protection — blocks connections to known malicious domains used for command-and-control
- Automated investigation — when ransomware behaviour is detected, Defender automatically isolates the affected device and begins remediation
Device isolation: the critical first response
When Defender identifies an active ransomware attack, it can automatically isolate the affected device — cutting it off from the network while maintaining the management connection to Defender. This contains the attack to one device and prevents lateral movement to file shares and other endpoints. Optimyze configures automatic isolation for high-severity alerts on all managed clients.
The backup layer every business also needs
Defender for Business is an excellent preventive and detective layer. But no security tool has 100% effectiveness. Every business also needs immutable, offline backups that ransomware can't reach and encrypt. Optimyze deploys Microsoft 365 Cloud Backup (for Exchange, Teams, and SharePoint data) and advises on on-premises backup solutions as part of a complete ransomware resilience posture.
