Microsoft Detection and Response Team (DART) Archives - Page 3 of 3

Ghost in the shell: Investigating web shell attacks

February 4, 2020 TH Author china chopper, Cybersecurity, Detection and Response Team (DART), Endpoint security, GALLIUM, incident response, KRYPTON, Microsoft Defender Advanced Threat Protection, Microsoft Detection and Response Team (DART), Microsoft security intelligence, Security management, Threat protection, web shell, ZINC

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
The post Ghost in the shell: Investigating web shell attacks appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Threat hunting in Azure Advanced Threat Protection (ATP)

January 7, 2020 TH Author Azure Security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Detection and Response Team (DART)

DART was called into an engagement where the adversary had a foothold within the on-premises network, which had been gained through compromising cloud credentials. Luckily, this customer had deployed Azure ATP prior to the incident and it had already normalized authentication and identity transactions within the customer network.
The post Threat hunting in Azure Advanced Threat Protection (ATP) appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Norsk Hydro responds to ransomware attack with transparency

December 17, 2019 TH Author incident response, Microsoft Detection and Response Team (DART), Security management

Aluminum supplier Norsk Hydro was attacked by LockerGoga, a form of ransomware. Learn how the company recovered and got back to business as usual.
The post Norsk Hydro responds to ransomware attack with transparency appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Ransomware response—to pay or not to pay?

December 16, 2019 TH Author Detection and Response Team (DART), incident response, Microsoft Detection and Response Team (DART), Phishing

As part of Microsoft’s Detection and Response Team (DART) Incident Response engagements, we regularly get asked by customers about “paying the ransom” following a ransomware attack.
The post Ransomware response—to pay or not to pay? appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1

November 14, 2019 TH Author Azure Security, Microsoft Cloud App Security, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft Detection and Response Team (DART)

A series on DART’s tools, techniques, and procedures for investigating cybersecurity incidents at their customer organizations. Part 1 introduces the team and gives a brief overview of the tools that DART utilizes.
The post Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1 appeared first on Microsoft Security. READ MORE HERE…