Link: https://linuxiac.com/microsoft-wants-to-protect-your-linux-desktop-with-defender/

Yes, you read that correctly. Microsoft is bringing its Defender security software to Linux desktops. The company has announced that Microsoft Defender for Endpoint now officially supports Linux desktop environments, with the feature currently available in public preview.

And before anyone starts wondering whether Microsoft has suddenly decided that every Linux user needs antivirus software, there’s an important distinction. This isn’t the consumer version of Defender familiar to Windows users. Instead, it’s Microsoft’s enterprise security platform for organizations running Linux workstations.

According to Microsoft, the expansion is driven by the growing use of Linux desktops among developers. These machines often access source code repositories, cloud infrastructure, credentials, and other sensitive resources, making them attractive targets for attackers.

The idea is to give enterprise security teams the same visibility and protection across Linux desktops that they already have for Windows, macOS, and Linux servers.

As for the capabilities, Defender for Endpoint provides real-time antivirus protection, endpoint detection and response, threat investigation, vulnerability management, and centralized security monitoring through the Microsoft Defender portal.

Security administrators can use these tools to investigate suspicious activity, identify compromised machines, and respond to threats without managing Linux workstations through a separate security platform.

Interestingly, Microsoft isn’t introducing a completely new Linux security agent for this purpose. According to its documentation, the desktop version uses the same deployment packages, installation methods, and security capabilities already available for Linux servers.

The supported distributions are also the same. The list includes Ubuntu LTS, Debian, Fedora, Red Hat Enterprise Linux, openSUSE Leap, SUSE Linux Enterprise, Rocky Linux, AlmaLinux, and several others.

Desktop environment choice doesn’t matter. Whether a workstation runs GNOME, KDE Plasma, or another graphical environment, compatibility depends on the underlying distribution and kernel rather than the desktop itself.

There’s also an interesting detail regarding device identification. Defender attempts to determine whether a Linux installation is a server or workstation using operating system metadata and other system characteristics. When it cannot reliably identify a machine as a workstation, it classifies it as a server by default.

Of course, Defender’s presence on Linux isn’t entirely new. Microsoft introduced its antivirus solution for Linux servers back in 2020, subsequently expanding its enterprise threat detection and response capabilities. What’s changing now is the official inclusion of desktop workstations.

Finally, it’s also worth emphasizing that this remains a public preview, not a generally available release. Organizations interested in deploying it will need an appropriate Microsoft Defender for Endpoint subscription and must meet the existing Linux system requirements.

For more details, see Microsoft’s official announcement

lol

lmao, even

I bet they would like that. They can fuck right off though.

Windows Defender is a good Antivirus, but which Linux user in their right mind would install Microsoft software voluntarily?

lol that’s gonna be a nope from me, dawg

Is this where they install the tracking ID too?

I'm good — there is nothing being installed on my systems that I don't know about, thanks.

"Would you like our spyware on your computer? We'll make sure we're the only spyware."

I think a general rule would be an antivirus unaffiliated with data center construction.

I switched to Linux to get away from Windows, thank you very much. I also won't forget how in 2014, the remains at an African-American gravesite got moved and damaged—just so they could build another data centre.

🤮

lmfao Seven Ah Ah Ah

VS Code is one of the most popular text editors (even among Linux users) and is developed by MS.

I use Emacs btw.

VScodium exists

vim better

They know they're at risk of losing their market share with Windows, so they're pivoting to Linux. They don't get that they're the virus!

My personal desktop? Hahahahahaha nope

My work laptop? Nervously shuffles this article under the rug before the C-suite finds it

Isn't it just a downstream fork? So, in a sense, still MS software.

My company has a "yOu neeD a ViRusscaNNer on YoUr BYOd" (even on Linux) I installed clamAV. The only thing it does is silence the IT guys.

No problemo, emacs has you covered with evil mode, so you can use vim keybindings in emacs.

It's closed source software, right?

I believe it is, but at least it has all MS nastiness stripped out

Yeah, similar here. We use Pareto Security (which is perfectly fine). I'm a bit worried though that some decision maker sees this and thinks "neat, now allachines can be managed via [whatever the Microsoft interface for that is called]

And also cannot ("legally") use the plugins that make vscode worth using in the first place

Subject to terms and conditions. Here's a message from our partners.

I've seen the server version in action. It hooks into the linux audit subsystem, and traces every system action and operation. The data it collects is super detailed, and designed to track which user, which program, and which servers are connected to, which files are read and written to track and potentially halt lateral movement through networks.

For regulated enterprise environments, it satisfies IDS/IPS/EDR requirements, and it's all wired up with their M365/Intune/Defender management portal. It makes some neat reports automatically about how data flows through a network, especially if all the points on your network are licensed ($$) and included in the defender system.

For personal systems. Yikes. Just Yikes.

It also relies on modern CPU features, so it would complain loudly about our older servers, and spam logs with messages about how it couldn't run, even though the system was updated to a current version of linux. It also had (last year?) some bugs that had it spinning wildly on a closed socket, which was fun to find :-/.

A couple of years ago they changed the phone policy, you can only read work email on your phone when you install Microsoft intune and basically give the company admin access. We all use personal phones (company doesn't provide them), so basically my entire team decided to just not get work emails on our phones. Most of my team is self employed (freelance). Now sometimes I get complaints I don't respond to emails quickly... Yeah what on earth could be the reason for that....

the title is wrong the body of the articke is correct. this isnt for you. this is for the enterprise who are already using defrnder (for enterprise) but want to add linux workstations

It's just another step in their EEE program.

I strongly disagree. I know this is the Internet consensus nowadays, but I have seen malware beating Defender multiple times. The last two times it was not zero day malware, but rather Defender failed due to architectural reasons. (not robust, reliable enough definition update mechanism & scanning stalled so the -relatively ancient- virus just disabled defender before it could've protected you)
The last time happened a little over a year ago, so it's not ancient history.

Sure, if you have a fresh WIndows install & Defender correctly updated its database, then it might benchmark very well. Detection itself will only stall under very specific circumstances that are not uncommon, but will not occur on a typical test rig.

I have never seen such problems with Eset & Bitdefender. Even Kasparesky is doing a better job at pretending to be not spyware but an actual security suite than Defender.

but.. you read the article right.. right... this is only for enterprise

Microsoft can walk west until their hats float.

https://www.guitarworld.com/features/the-truth-behind-lee-sklars-custom-producers-switch

As someone who worked in cybersecurity, amd left because the whole field is just snake-oil amd scam, I totally get you.

The field is not for anyone who actually cares about security. It took me few years of trying to realize that, and I left once I found out, but the truth is...

There are mandated check-lists and standarts. There's a box for every PC having an AV. There's a box saying that "this app is pen-tested yearly by someone with a pentest certification", or " the company is using a certified communicatiom channel".

It does not say that you have to fix the things they found in the pentest. It does not ask whether the "certified platform" is selling your data, or is owned by US, or not.

The whole field is just a bunch of extremely annoying checkboxes for company to deal with, and doing it well is actually an annoyance, and they are willing to pay extra so they don't have to do that.

I've seen the same critical vulnerabity repeating for 5 years in each yearly pentest, because the checkbox for ISO just says they do the test. Ot sucks.

But I see where is MS going with this. Ot's exactly for this - to have an easy way how to fill the checkbox of "you have certified AV on every device".

As a former it guy... We just enforce what someone in the chain came up with.

I tried that, and it was incredibly slow for me. I tried to use eMacs because of the org mode, but eventually I gave up and returned to markdown and vim.

I think you need a good understanding of why would you want to have eMacs with vim keybindings. Perhaps that’s super useful for someone, but I just gave up for now.

Tried what I thought the opposite side is, Helix. Didn’t work for me either. I’m with vim for now, may reconsider at some later point, when I’d have more resources to learn and explore.

What exactly was slow? For me it was the natural choice to use evil, since I used vim before. The biggest change was not opening and closing the editor all the time, as i did with vim. You just keep emacs open and if you absolutely need a terminal, you open one in emacs.

Opening was very slow: instant vs maybe 30 sec sometimes. I won’t recall. I agree, a new tool may want a different perspective and use patterns. So I don’t blame it, just I initially thought it would be the same thing, as it’s evil mode, but realised I need to invest more into the setup, and I had no resources for that at the time. May try again later.

There's also KATE and a few other editors running natively on your PC rather than in a browser...