{"id":38616,"date":"2020-12-09T17:00:18","date_gmt":"2020-12-09T17:00:18","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=92335"},"modified":"2020-12-09T17:00:18","modified_gmt":"2020-12-09T17:00:18","slug":"edr-in-block-mode-stops-icedid-cold","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/","title":{"rendered":"EDR in block mode stops IcedID cold"},"content":{"rendered":"<p>We are happy to announce the general availability of endpoint detection and response (EDR) in block mode in Microsoft Defender for Endpoint. EDR in block mode turns EDR detections into real-time blocking of malicious behaviors, malware, and artifacts. It uses Microsoft Defender for Endpoint\u2019s industry-leading visibility and detection capabilities and Microsoft Defender Antivirus\u2019s built-in blocking function to provide an additional layer of post-breach protection in cases where the primary antivirus misses a threat.<\/p>\n<p>EDR in block mode extends the behavioral blocking and containment capabilities in Microsoft Defender for Endpoint, thwarting attack chains that could allow attackers to gain a foothold on a device and, consequently, a network. For each malicious behavior or malware blocked, EDR in block raises an alert in Microsoft Defender Security Center, enabling security teams to perform additional investigation and hunting and comprehensively resolve attacks.<\/p>\n<p>Since being available for <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/microsoft-defender-for-endpoint\/introducing-edr-in-block-mode-stopping-attacks-in-their-tracks\/ba-p\/1596617\">public preview<\/a> in August, EDR in block mode has helped customers to stop a wide range of threats, especially in cases where Microsoft Defender Antivirus isn\u2019t the primary antivirus. Below we describe an IcedID campaign, one of many attacks foiled by EDR in block mode. In this incident, the organization\u2019s non-Microsoft antivirus solution missed the malware, but Microsoft Defender for Endpoint picked up the malicious behavior. EDR in block mode kicked in and protected the device from a series of malicious activities that include evasive attacker techniques like process hollowing and steganography that lead to the deployment of the info-stealing IcedID malware.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-92336 aligncenter\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/IcedID-attack-chain.png\" alt=\"Diagram showing IcedID attack chain, with labels identifying what stage the attack was stopped\" width=\"985\" height=\"852\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/IcedID-attack-chain.png 985w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/IcedID-attack-chain-300x259.png 300w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/IcedID-attack-chain-768x664.png 768w\" sizes=\"auto, (max-width: 985px) 100vw, 985px\"><\/p>\n<p><em>Figure 1. IcedID attack chain stopped by EDR in block mode<\/em><\/p>\n<h2>How EDR in block mode stopped an IcedID attack<\/h2>\n<p>On October 13, attackers launched a new campaign to distribute the IcedID malware. IcedID is a banking trojan that remains in memory, monitors traffic to banking domains and financial websites, and steals sensitive financial information. It has also been observed to modify site content to redirect traffic to malicious sites for the same purpose.<\/p>\n<p>As in many past IcedID campaigns, this attack started with an email carrying a malicious attachment, in this case, a password-protected archive file. The emails used the <a href=\"https:\/\/twitter.com\/MsftSecIntel\/status\/1296854458098315264\">fake reply<\/a> technique and contained the password to the archive file.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-92337\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/email.png\" alt=\"Screenshot of spear-phishing email used in the IcedID campaign\" width=\"862\" height=\"594\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/email.png 862w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/email-300x207.png 300w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/email-768x529.png 768w\" sizes=\"auto, (max-width: 862px) 100vw, 862px\"><\/p>\n<p><em>Figure 2. Spear-phishing email used in the IcedID campaign<\/em><\/p>\n<p>The archive file contained a document with malicious obfuscated macro code. When enabled, the malicious macro connects to a remote site to attempt to download the IcedID loader, which would in turn download and run the main IcedID malware.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-92338\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro.png\" alt=\"Screenshot of malicious document and malicious macro codes\" width=\"1640\" height=\"488\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro.png 1640w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro-300x89.png 300w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro-1024x305.png 1024w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro-768x229.png 768w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/Malicious-document-with-macro-1536x457.png 1536w\" sizes=\"auto, (max-width: 1640px) 100vw, 1640px\"><\/p>\n<p><em>Figure 3. Document with malicious macro<\/em><\/p>\n<p>In customer environments protected by Microsoft for Defender Endpoint with Microsoft Defender Antivirus as the primary antivirus, the attack was blocked. Microsoft Defender for Endpoint uses <a href=\"https:\/\/docs.microsoft.com\/windows\/desktop\/amsi\/antimalware-scan-interface-portal\">Anti-malware Scan Interface (AMSI)<\/a> and <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/08\/27\/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning\/\">specialized machine learning classifiers<\/a> on the client and in the cloud to detect malicious macro behavior.<\/p>\n<p>In one environment that wasn\u2019t using Microsoft Defender Antivirus, the primary antivirus solution missed the campaign, so when the user opened the document and enabled the macro, the malicious code started connecting to the command-and-control (C2) server. Microsoft Defender for Endpoint\u2019s EDR capabilities, however, detected the malicious macro behavior.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-92340\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-suspicious-behavior.png\" alt=\"Screenshot of Microsoft Defender Security Center alert indicating detection of suspicious behavior\" width=\"836\" height=\"1012\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-suspicious-behavior.png 836w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-suspicious-behavior-248x300.png 248w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-suspicious-behavior-768x930.png 768w\" sizes=\"auto, (max-width: 836px) 100vw, 836px\"><\/p>\n<p><em>Figure 4. Microsoft Defender Security Center alert for malicious macro behavior<\/em><\/p>\n<p>EDR in block mode, which was enabled on the environment, kicked in and instantly blocked the malicious document, preventing a chain of evasive attacker activities that could have led to the IcedID malware being installed.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-92339\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-malware-blocked.png\" alt=\"Screenshot of Microsoft Defender Security Center alert indicating threat is blocked\" width=\"836\" height=\"963\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-malware-blocked.png 836w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-malware-blocked-260x300.png 260w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/alert-malware-blocked-768x885.png 768w\" sizes=\"auto, (max-width: 836px) 100vw, 836px\"><\/p>\n<p><em>Figure 5. Microsoft Defender Security Center alert for the blocked IcedID malware <\/em><\/p>\n<h2>The attack that could have been<\/h2>\n<p>This IcedID campaign shows why blocking malicious behavior and attacks in real time, especially in the earlier stages of the attack, is critical in preventing the full impact of threats. After gaining access to a device, attackers bring in sophisticated tools and utilize advanced techniques to operate stealthily on a system.<\/p>\n<p>For example, if the IcedID macro isn\u2019t blocked from running, it downloads a DLL file disguised as a CAB file from <em>hxxp:\/\/h4dv4c1w[.]com\/ryfu\/bary[.]php?l=konu13[.]cab<\/em>. This DLL file is saved as <em>[random].txt<\/em> and is executed using <em>regsvr32.exe<\/em>. The DLL then downloads <em>jazzcity.top<\/em>, an encrypted PNG file that contains malware code. This technique of hiding malicious code in image files, called steganography, is used by attackers to evade detection.<\/p>\n<p>When decrypted, the PNG file creates an <em>msiexec.exe<\/em> process and uses <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2017\/07\/12\/detecting-stealthier-cross-process-injection-techniques-with-windows-defender-atp-process-hollowing-and-atom-bombing\/\">process hollowing<\/a>, a stealthy cross-process injection technique, to inject malicious code. The hollowed-out <em>msiexec.exe<\/em> process then creates the file <em>joavript.dll<\/em>, which is the decrypted IcedID malware.<\/p>\n<p>Once in memory, the IcedID malware acts as the middleman between the browser and the banking site. It does this by creating a self-signed certificate and by hooking the browser to accept this certificate.&nbsp; This allows IcedID to monitor HTTPS traffic to online banking sites and manipulate and steal information.<\/p>\n<h2>EDR in block mode: Transforming EDR visibility into real-time blocking<\/h2>\n<p>With endpoint and detection response (EDR) in block mode, now generally available, Microsoft Defender for Endpoint provides another layer of post-breach protection when attacks manage to slip past the primary antivirus solution. An extension of the behavioral blocking and containment capabilities, EDR in block mode stops attacks cold when it detects malicious behavior, malware implant, and other artifacts. It stops and blocks malicious behavior in real-time, even if a threat has started running, helping ensure that attacks are not allowed to proceed and achieve their endgame.<\/p>\n<p>EDR in block mode can be enabled thru the advanced settings in Microsoft Defender Security Center. Organizations that have not enabled this feature will also get security recommendation to do so via the threat and vulnerability management feature. To learn more, read the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/microsoft-defender-atp\/edr-in-block-mode\">EDR in block mode documentation<\/a>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-92341 aligncenter\" src=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/EDR-in-block-mode-advanced-setting.png\" alt=\"Screenshot of advanced settings in Microsoft Defender Security Center, where EDR in block mode can be enabled\" width=\"936\" height=\"144\" srcset=\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/EDR-in-block-mode-advanced-setting.png 936w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/EDR-in-block-mode-advanced-setting-300x46.png 300w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/EDR-in-block-mode-advanced-setting-768x118.png 768w, https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/12\/EDR-in-block-mode-advanced-setting-930x144.png 930w\" sizes=\"auto, (max-width: 936px) 100vw, 936px\"><\/p>\n<p><em>Figure 6. Enable EDR in block mode in advanced features in Microsoft Defender Security Center<\/em><\/p>\n<p>EDR in block mode is part of the comprehensive endpoint protection provided by Microsoft Defender for Endpoint, which delivers preventative protection, post-breach detection, automated investigation, and response. <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/security\/endpoint-defender\">Learn how you can secure your organization with Microsoft Defender for Endpoint<\/a>.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/12\/09\/edr-in-block-mode-stops-icedid-cold\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Endpoint detection and response (EDR) in block mode in Microsoft Defender for Endpoint turns EDR detections into real-time blocking of threats. Learn how it stopped an IcedID attack.<br \/>\nThe post EDR in block mode stops IcedID cold appeared first on Microsoft Security. READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":38617,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[276],"tags":[347,9086,8484,927,9087,7221],"class_list":["post-38616","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-secure","tag-cybersecurity","tag-edr-in-block-mode","tag-endpoint-detection-and-response-edr","tag-icedid","tag-microsoft-defender-for-endpoint","tag-microsoft-security-intelligence"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-12-09T17:00:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png\" \/>\n\t<meta property=\"og:image:width\" content=\"985\" \/>\n\t<meta property=\"og:image:height\" content=\"852\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"EDR in block mode stops IcedID cold\",\"datePublished\":\"2020-12-09T17:00:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/\"},\"wordCount\":999,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/edr-in-block-mode-stops-icedid-cold.png\",\"keywords\":[\"Cybersecurity\",\"EDR in block mode\",\"endpoint detection and response (EDR)\",\"IcedID\",\"Microsoft Defender for Endpoint\",\"Microsoft security intelligence\"],\"articleSection\":[\"Microsoft Secure\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/\",\"name\":\"EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/edr-in-block-mode-stops-icedid-cold.png\",\"datePublished\":\"2020-12-09T17:00:18+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/edr-in-block-mode-stops-icedid-cold.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/edr-in-block-mode-stops-icedid-cold.png\",\"width\":985,\"height\":852},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/edr-in-block-mode-stops-icedid-cold\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/cybersecurity\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"EDR in block mode stops IcedID cold\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/","og_locale":"en_US","og_type":"article","og_title":"EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-12-09T17:00:18+00:00","og_image":[{"width":985,"height":852,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"EDR in block mode stops IcedID cold","datePublished":"2020-12-09T17:00:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/"},"wordCount":999,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png","keywords":["Cybersecurity","EDR in block mode","endpoint detection and response (EDR)","IcedID","Microsoft Defender for Endpoint","Microsoft security intelligence"],"articleSection":["Microsoft Secure"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/","url":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/","name":"EDR in block mode stops IcedID cold 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png","datePublished":"2020-12-09T17:00:18+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/12\/edr-in-block-mode-stops-icedid-cold.png","width":985,"height":852},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/edr-in-block-mode-stops-icedid-cold\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity","item":"https:\/\/www.threatshub.org\/blog\/tag\/cybersecurity\/"},{"@type":"ListItem","position":3,"name":"EDR in block mode stops IcedID cold"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=38616"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38616\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/38617"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=38616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=38616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=38616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}