Skip to content
Microsoft Secure
Clear All Apply Filters (171) Loading...
Your selected filters are:

    Blog Posts

    Windows Defender ATP

    Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

    By
    In MITRE’s evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine learning, heuristics, and behavior monitoring delivered comprehensive coverage of attacker techniques across the entire attack chain. MITRE tested the...

    Read more

    Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers

    By
    Reuters recently reported a hacking campaign focused on a wide range of targets across the globe. In the days leading to the Reuters publication, Microsoft researchers were closely tracking the same campaign. Our sensors revealed that the campaign primarily targeted public sector institutions and non-governmental organizations like think tanks and research centers, but also included...

    Read more

    Windows Defender ATP device risk score exposes new cyberattack, drives Conditional access to protect networks

    By
    Several weeks ago, the Windows Defender Advanced Threat Protection (Windows Defender ATP) team uncovered a new cyberattack that targeted several high-profile organizations in the energy and food and beverage sectors in Asia. Given the target region and verticals, the attack chain, and the toolsets used, we believe the threat actor that the industry refers to...

    Read more

    What’s new in Windows Defender ATP

    By
    We added new capabilities to each of the pillars of Windows Defender ATP’s unified endpoint protection platform: improved attack surface reduction, better-than-ever next-gen protection, more powerful post-breach detection and response, enhanced automation capabilities, more security insights, and expanded threat hunting. These enhancements boost Windows Defender ATP and accrue to the broader Microsoft Threat Protection, an...

    Read more

    Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets

    By
    Our analysis of a targeted attack that used a language-specific word processor shows why it’s important to understand and protect against small-scale and localized attacks as well as broad-scale malware campaigns. The attack exploited a vulnerability in InPage, a word processor software for specific languages like Urdu, Persian, Pashto, and Arabic. More than 75% of...

    Read more

    Windows Defender Antivirus can now run in a sandbox

    By
    Windows Defender Antivirus has hit a new milestone: the built-in antivirus capabilities on Windows can now run within a sandbox. With this new development, Windows Defender Antivirus becomes the first complete antivirus solution to have this capability and continues to lead the industry in raising the bar for security. Putting Windows Defender Antivirus in a...

    Read more

    Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

    By
    Removing the need for files is the next progression of attacker techniques. While fileless techniques used to be employed almost exclusively in sophisticated cyberattacks, they are now becoming widespread in common malware, too....

    Read more

    Office VBA + AMSI: Parting the veil on malicious macros

    By
    As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior. Macro-based threats have always been a prevalent entry point for malware, but we...

    Read more

    Small businesses targeted by highly localized Ursnif campaign

    By
    In social engineering attacks, is less really more? A new malware campaign puts that to the test by targeting home users and small businesses in specific US cities. This was a focused, highly localized attack that aimed to steal sensitive info from just under 200 targets. Macro-laced documents masqueraded as statements from legitimate businesses. The...

    Read more

    Load more