Skip to content
Microsoft Secure
Clear All Apply Filters (151) Loading...
Your selected filters are:

    Blog Posts

    Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

    By
    Removing the need for files is the next progression of attacker techniques. While fileless techniques used to be employed almost exclusively in sophisticated cyberattacks, they are now becoming widespread in common malware, too....

    Read more

    Office VBA + AMSI: Parting the veil on malicious macros

    By
    As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior. Macro-based threats have always been a prevalent entry point for malware, but we...

    Read more

    Small businesses targeted by highly localized Ursnif campaign

    By
    In social engineering attacks, is less really more? A new malware campaign puts that to the test by targeting home users and small businesses in specific US cities. This was a focused, highly localized attack that aimed to steal sensitive info from just under 200 targets. Macro-laced documents masqueraded as statements from legitimate businesses. The...

    Read more

    Protecting the protector: Hardening machine learning defenses against adversarial attacks

    By
    Harnessing the power of machine learning and artificial intelligence has enabled Windows Defender Advanced Threat Protection (Windows Defender ATP) next-generation protection to stop new malware attacks before they can get started – often within milliseconds. These predictive technologies are central to scaling protection and delivering effective threat prevention in the face of unrelenting attacker activity....

    Read more

    Protecting the modern workplace from a wide range of undesirable software

    By
    Security is a fundamental component of the trusted and productive Windows experience that we deliver to customers through modern platforms like Windows 10 and Windows 10 in S mode. As we build intelligent security technologies that protect the modern workplace, we aim to always ensure that customers have control over their devices and experiences. To...

    Read more

    Attack inception: Compromised supply chain within a supply chain poses new risks

    Attack inception: Compromised supply chain within a supply chain poses new risks

    By
    A new software supply chain attack unearthed by Windows Defender Advanced Threat Protection (Windows Defender ATP) emerged as an unusual multi-tier case. Unknown attackers compromised the shared infrastructure in place between the vendor of a PDF editor application and one of its software vendor partners, making the app’s legitimate installer the unsuspecting carrier of a...

    Read more

    March-April 2018 test results: More insights into industry AV tests

    By
    In a previous post, in the spirit of our commitment to delivering industry-leading protection, customer choice, and transparency on the quality of our solutions, we shared insights and context into the results of AV-TEST’s January-February 2018 test cycle. We released a transparency report to help our customers and the broader security community to stay informed...

    Read more

    Hawkeye Keylogger – Reborn v8: An in-depth campaign analysis

    By
    Much of cybercrime today is fueled by underground markets where malware and cybercriminal services are available for purchase. These markets in the deep web commoditize malware operations. Even novice cybercriminals can buy malware toolkits and other services they might need for malware campaigns: encryption, hosting, antimalware evasion, spamming, and many others. Hawkeye Keylogger is an...

    Read more

    Taking apart a double zero-day sample discovered in joint hunt with ESET

    By
    In late March 2018, I analyzed an interesting PDF sample found by ESET senior malware researcher Anton Cherepanov. The sample was initially reported to Microsoft as a potential exploit for an unknown Windows kernel vulnerability. During my investigation in parallel with ESET researchers, I was surprised to discover two new zero-day exploits in the same PDF....

    Read more

    The need and opportunity for adaptive prevention in the cloud

    By
    This post is authored by Michael Bargury, Data Scientist, C+E Security.  The need The cloud introduces new security challenges, which differ from classic ones by diversity and scale. Once a Virtual Machine (VM) is up and running with an open internet port, it is almost instantaneously subject to vulnerability scanning and Brute Force (BF) attacks....

    Read more

    Load more