Document Details

The documentation page demonstrates a Windows bias in several ways: it frequently references Windows-specific tools and technologies (such as PowerShell and WMI), and focuses on Microsoft Defender for Endpoint, which is primarily a Windows-centric solution. Examples of suspicious activity are almost exclusively described in terms of Windows tools (PowerShell, WMI) and Microsoft cloud services, with no mention of Linux equivalents (such as Bash, SSH, systemd, or Linux-native credential theft tools). There are no examples or scenarios that reference Linux-specific attack patterns, tools, or detection methods, and the documentation does not provide parity for Linux environments in its threat descriptions or incident scenarios.