Microsoft previews automatic device isolation in Defender for Endpoint

Microsoft is previewing automatic device isolation in Defender for Endpoint's auto attack disruption tool, which blocks most network traffic on a compromised device while keeping it connected to security services. The feature aims to contain attacks moving at machine speed by cutting off C2 communication and preventing lateral movement. However, a SANS Institute research paper warns that the tool can be weaponized: a researcher demonstrated an 'Autonomous Defense Induced Disruption' (ADID) attack that tricks Defender into disabling all Active Directory identities, including domain administrators, by simulating high-confidence attack signals. Microsoft recommends keeping auto attack disruption enabled with granular tuning by device group, rather than opting out entirely.