Disruptors Unleashed: MDE x Intune Warfare

Welcome to the war room. This isn’t a talk — it’s a battleground. And today, we’re unleashing the disruptors.

Defender for Endpoint and Intune aren’t just tools — they’re weapons. One disrupts active threats mid-kill chain, the other enforces silent control across every device you own.

In a world where attackers live off the land, blend in with traffic, and evade detection — you need more than EDR alerts. You need real-time disruption. You need automated enforcement. You need combined arms security.

This is where purple teaming gets real. We’ll simulate the breach, pull apart live threat signals, and fire back with precision: isolation, revocation, and enforced compliance.

The first talk will drop you deep into the guts of Defender for Endpoint’s Attack Disruption capability — the one that doesn’t just detect, but automatically kicks attackers off the network mid-operation.

We’ll reverse-engineer the disruption logic, simulate real-world attacks to trigger it, and walk through the purple methodology that blends threat intel, signal fusion, and automated containment.

You’ll learn how Defender correlates lateral movement, identity compromise, and persistence attempts into real-time disruption actions — and how red teams can pressure-test the logic while blue teams prepare the blast radius.

This second talk breaks down how Microsoft Intune becomes a frontline weapon in endpoint security, before the attacker even lands.
We’ll deep-dive into Intune’s Security Baselines, MDM lockdowns, AppLocker policies, and Threat Protection configurations, building a layered defense that shrinks attack surface and starves post-compromise movement.

Why Attend?

This isn’t a typical 101 meetup. It’s a live and technical demo focused on how attackers think and how defenders can evolve. Whether you build or break policies, you’ll leave with new insights and practical takeaways.
The meetup will be part of the new cooperation with Workplace Ninja.

AGENDA

17:15 > Break the ice and Beers
18:00 > Interrupt the Kill Chain: Inside MDE’s Attack Disruption by Ami Barayev
18:45 > Pizzas and Beers
19:00 > Silent Control: Weaponizing Intune for Endpoint Defense by Itzik Tzadaka
19:45 > Closing

NOTES

• Content Level - 300-400
• ​The event is physical at the Microsoft Reactor TLV
• ​​The event will not be streamed or recorded

​COMMUNITY CHANNELS

MSFT.SEC.ADVOCATE on WhatsApp
WorkplaceNinja.IL on WhatsApp
Community Notifications on WhatsApp
A landing page for all Community Groups
The User Groups IL on LinkedIn