Microsoft Defender for Endpoint - demonstration scenarios

Applies to:

• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender for Business
• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender Antivirus
• Microsoft Defender for Individuals

The following demonstration scenarios will help you learn about the capabilities of Microsoft Defender for Endpoint on Windows, Mac, and Linux. Demonstration scenarios are provided for the following Microsoft Defender for Endpoint protection areas:

• Attack surface protection (ASR)
• Next Generation Protection (NGP)
• Endpoint detection and response (EDR)

Note

None of the sample files or suspicious links provided in this collection are actually malicious; all links and demonstration files are harmless.

We encourage you to read Microsoft Defender Antivirus documentation, and to download the Evaluation guide.

Demonstrations

The following table lists the available demonstrations alphabetically, with their associated protection area.

#	Demonstration name	Protection area	Description
1	Endpoint Detection and Response (EDR) detections	EDR	Confirm that EDR is detecting cyber threats such as malware.
2	Validate antimalware	NGP	Confirm that antivirus/antimalware is detecting and blocking malware.
3	Potentially unwanted applications (PUA) demonstration	NGP	Confirm that potentially unwanted applications (PUAs) are being blocked on your network by downloading a fake (safe) PUA file.
4	Cloud-delivered protection demonstration	NGP	Confirm that cloud-delivered protection is working properly on your computer.
5	App reputation demonstration	NGP	Navigate to the app reputation page to see the demonstration scenario using Microsoft Edge.
6	URL reputation demonstrations	NGP	Navigate to the URL Reputation page to see the demonstration scenarios using Microsoft Edge.
7	Network protection demonstrations	ASR	Navigate to a suspicious URL to trigger network protection.
8	Attack surface reduction rules (ASR rules) demonstrations	ASR	Download sample files to trigger each ASR rule.
9	Exploit protection (EP) demonstrations	ASR	Apply custom exploit protection settings.
10	Controlled folder access (CFA) demonstration (block script)	ASR	Download the CFA test tool.
11	Controlled folder access (CFA) demonstrations (block ransomware)	ASR	Download and execute a sample file to trigger CFA ransomware protection.

See also

Attack surface protection (ASR) overview Test attack surface reduction rules Next Generation Protection (NGP) overview Endpoint detection and response (EDR) overview Microsoft Defender for Endpoint security blog

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.