incident response Archives - ThreatsHub Cybersecurity News

Microsoft open sources CodeQL queries used to hunt for Solorigate activity

February 25, 2021 TH Author CodeQL, Cybersecurity, incident response, Microsoft security intelligence, Security Intelligence, Solorigate

We are sharing the CodeQL queries that we used to analyze our source code at scale and rule out the presence of the code-level indicators of compromise (IoCs) and coding patterns associated with Solorigate so that other organizations may perform a similar analysis.
The post Microsoft open sources CodeQL queries used to hunt for Solorigate activity appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Advice for incident responders on recovery from systemic identity compromises

December 21, 2020 TH Author Cybersecurity, Endpoint security, incident response, Microsoft security intelligence

Customers across the globe are asking for guidance on recovering their infrastructure after being impacted by Solorigate. DART walks you through remediation steps as well as some longer term mitigations.
The post Advice for incident responders on recovery from systemic identity compromises appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Empower your analysts to reduce burnout in your security operations center

July 28, 2020 TH Author Cybersecurity, Cybersecurity Policy, incident response, Operations

Strategic use of automation and metrics can help you create a continuous learning culture that keeps your team engaged in the work.
The post Empower your analysts to reduce burnout in your security operations center appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Hello open source security! Managing risk with software composition analysis

July 20, 2020 TH Author Cybersecurity, incident response, Security strategies

Software composition analysis guides the selection and management of open source components to help you reduce your security risk.
The post Hello open source security! Managing risk with software composition analysis appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

How to gain 24/7 detection and response coverage with Microsoft Defender ATP

May 6, 2020 TH Author Cybersecurity, incident response, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Intelligent Security Association (MISA), MISA, Security Intelligence, Security strategies

Security incidents don’t happen exclusively during business hours: attackers often wait until the late hours of the night to breach an environment.
The post How to gain 24/7 detection and response coverage with Microsoft Defender ATP appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Lessons learned from the Microsoft SOC—Part 3c: A day in the life part 2

May 5, 2020 TH Author cloud computing, Cybersecurity, Detection and Response Team (DART), Endpoint security, incident response, Microsoft Cloud App Security, Microsoft Detection and Response Team (DART), Microsoft security intelligence

This blog wraps up the day in the life of a SOC analyst on the investigation team with insights on remediating incidents, post-incident cleanup, and impact of COVID-19 on the SOC. This is the sixth blog post in the series.
The post Lessons learned from the Microsoft SOC—Part 3c: A day in the life part 2 appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Defending the power grid against supply chain attacks: Part 3 – Risk management strategies for the utilities industry

April 22, 2020 TH Author Advanced Threat Analytics, Cybersecurity, Cybersecurity deployment, Cybersecurity Policy, Data Privacy, Evolution of Microsoft Threat Protection, Evolution of Microsoft Threat Protection page, incident response, Information/data protection, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Detection and Response Team (DART), Microsoft security intelligence, Network Security, Security Intelligence, Security Response, Security strategies, Windows Security

By working with governments, trade organizations, and suppliers, the utility industry can improve security across the supply chain.
The post Defending the power grid against supply chain attacks: Part 3 – Risk management strategies for the utilities industry appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

MITRE ATT&CK APT 29 evaluation proves Microsoft Threat Protection provides deeper end to end view of advanced threats

April 21, 2020 TH Author Advanced Threat Analytics, Azure Security, Cybersecurity, Cybersecurity Policy, Evolution of Microsoft Threat Protection, Evolution of Microsoft Threat Protection page, incident response, Security Intelligence, Security Response, Threat protection

During the MITRE ATT&CK evaluation, Microsoft Threat Protection delivered on providing the deepest optics, near real time detection, and a complete view of the attack story.
The post MITRE ATT&CK APT 29 evaluation proves Microsoft Threat Protection provides deeper end to end view of advanced threats appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Microsoft shares new threat intelligence, security guidance during global crisis

April 8, 2020 TH Author coronavirus-themed threats, COVID-19 themed attacks, Cybersecurity, emotet, incident response, Microsoft security intelligence, Phishing, Security Intelligence, Security Response, TrickBot

Our threat intelligence shows that COVID-19 themed threats are retreads of existing attacks that have been slightly altered to tie to the pandemic. We’re seeing a changing of lures, not a surge in attacks. These attacks are settling into the normal ebb and flow of the threat environment.
The post Microsoft shares new threat intelligence, security guidance during global crisis appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Ghost in the shell: Investigating web shell attacks

February 4, 2020 TH Author china chopper, Cybersecurity, Detection and Response Team (DART), Endpoint security, GALLIUM, incident response, KRYPTON, Microsoft Defender Advanced Threat Protection, Microsoft Detection and Response Team (DART), Microsoft security intelligence, Security management, Threat protection, web shell, ZINC

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
The post Ghost in the shell: Investigating web shell attacks appeared first on Microsoft Security. READ MORE HERE…

← Previous