Microsoft Defender Advanced Threat Protection Archives - Page 4 of 5

Ghost in the shell: Investigating web shell attacks

February 4, 2020 TH Author china chopper, Cybersecurity, Detection and Response Team (DART), Endpoint security, GALLIUM, incident response, KRYPTON, Microsoft Defender Advanced Threat Protection, Microsoft Detection and Response Team (DART), Microsoft security intelligence, Security management, Threat protection, web shell, ZINC

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
The post Ghost in the shell: Investigating web shell attacks appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Threat hunting in Azure Advanced Threat Protection (ATP)

January 7, 2020 TH Author Azure Security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Detection and Response Team (DART)

DART was called into an engagement where the adversary had a foothold within the on-premises network, which had been gained through compromising cloud credentials. Luckily, this customer had deployed Azure ATP prior to the incident and it had already normalized authentication and identity transactions within the customer network.
The post Threat hunting in Azure Advanced Threat Protection (ATP) appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

CISO series: Lessons learned from the Microsoft SOC—Part 3b: A day in the life

December 23, 2019 TH Author CISO series, Ciso series page, Endpoint security, incident response, Lessons learned, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP

In this next post in our series, we provide insight into a day in the life of our SOC analysts investigating common front door attacks.
The post CISO series: Lessons learned from the Microsoft SOC—Part 3b: A day in the life appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Mobile threat defense and intelligence are a core part of cyber defense

December 19, 2019 TH Author Endpoint security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Intelligent Security Association (MISA), Mobile Security

To safeguard company assets, organizations need to augment their global cyber defense strategy with mobile threat intelligence.
The post Mobile threat defense and intelligence are a core part of cyber defense appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

December 18, 2019 TH Author AI and machine learning, Automation, brute force attack, Cybersecurity, data science, Endpoint security, Event ID 4625, Microsoft Defender Advanced Threat Protection, Microsoft security intelligence, Microsoft Threat Experts, probablistic time series model, Remote Desktop Protocol (RDP), Security Intelligence, Threat protection, Windows Security

Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats.
The post Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

GALLIUM: Targeting global telecom

December 12, 2019 TH Author Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft security intelligence, Security Intelligence, Threat protection

Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers.
The post GALLIUM: Targeting global telecom appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Improve cyber supply chain risk management with Microsoft Azure

December 9, 2019 TH Author Azure Security, Endpoint security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Zero Trust

To keep government agencies secure in the cloud, we must keep pace and stay ahead of cyber attackers by defending the cyber supply chain with Microsoft Azure.
The post Improve cyber supply chain risk management with Microsoft Azure appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Spear phishing campaigns—they’re sharper than you think

December 2, 2019 TH Author CISO series, Ciso series page, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Phishing

Spear phishing campaigns can be highly effective—but they aren’t foolproof. If you understand how they work, you can put measures in place to reduce their power.
The post Spear phishing campaigns—they’re sharper than you think appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1

November 14, 2019 TH Author Azure Security, Microsoft Cloud App Security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Detection and Response Team (DART)

A series on DART’s tools, techniques, and procedures for investigating cybersecurity incidents at their customer organizations. Part 1 introduces the team and gives a brief overview of the tools that DART utilizes.
The post Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1 appeared first on Microsoft Security. READ MORE HERE…