Antimalware research for IT pros and enthusiasts

Windows Defender ATP thwarts Operation WilySupply software supply chain cyberattack

May 4, 2017 admin Advanced persistent threats, alert timelines, Altair Technologies EvLog, Antimalware research for IT pros and enthusiasts, Cyberattack, ESTsoft ALZip, Evil Grade, finance, financials, high technology, Kerberoast, MAPP, Meterpreter, Mimikatz, MSRC, Operation WilySupply, pen-testing tools, Powershell, process trees, research, Rivit, SimDisk, software supply chain, ue.exe, update channel, updater, WDATP, Windows Defender Advanced Threat Protection, Windows Defender ATP

Credit to Author: msft-mmpc| Date: Thu, 04 May 2017 16:29:18 +0000

Several weeks ago, the Windows Defender Advanced Threat Protection (Windows Defender ATP) research team noticed security alerts that demonstrated an intriguing attack pattern. These early alerts uncovered a well-planned, finely orchestrated cyberattack that targeted several high-profile technology and financial organizations. An unknown attacker was taking advantage of a silent yet effective attack vector: the compromised…

Microsoft Security

Combating a spate of Java malware with machine learning in real-time

April 20, 2017 admin Antimalware research for IT pros and enthusiasts, automation, cloud protection, Creators Update, Java, Java malware, machine learning, obfuscation, Social engineering, spam, Threat Intelligence, Windows 10, Windows 10 Creators Update, Windows Defender Antivirus

Credit to Author: msft-mmpc| Date: Thu, 20 Apr 2017 13:02:00 +0000

In recent weeks, we have seen a surge in emails carrying fresh malicious Java (.jar) malware that use new techniques to evade antivirus protection. But with our research team’s automated expert systems and machine learning models, Windows 10 PCs get real-time protection against these latest threats. Attackers are constantly changing their methods and tools. We…

Microsoft Security

Tech support scams persist with increasingly crafty techniques

April 3, 2017 admin Antimalware research for IT pros and enthusiasts, Creators Update, Cusax, FakeBSOD, FakeCall, Hicurdismos, Microsoft Edge, Monitev, SupportScam, tech support scam, Techbrolo, Windows 10, Windows Defender, Windows Defender Antivirus, Windows Defender SmartScreen

Credit to Author: msft-mmpc| Date: Mon, 03 Apr 2017 12:58:02 +0000

Millions of users continue to encounter technical support scams. Data from Windows Defender SmartScreen (which is used by both Microsoft Edge and Internet Explorer to block malicious sites) and Windows Defender Antivirus show that some three million users are subjected to these threats every month. In addition to being rampant, technical support scams continue to…

Microsoft Security

World Backup Day is as good as any to back up your data

March 28, 2017 admin 3-2-1 rule, Advanced persistent threats, Antimalware research for IT pros and enthusiasts, backup, Cerber, data-wiping malware, Depriz, Locky, Microsoft OneDrive, Microsoft OneDrive for Business, ransomware, ransomware backup and recovery, Windows Defender, Windows Defender Advaned Threat Protection, Windows Defender Antivirus

Credit to Author: msft-mmpc| Date: Tue, 28 Mar 2017 21:04:31 +0000

In today’s security landscape, there are more threats to data than ever before. Beyond corruption caused by hardware or human failure, malware and cyberattacks can put data in serious danger. That’s why it’s imperative for enterprises, small-and-medium businesses, and individuals to back up data. It must be implemented systematically, not just on World Backup Day,…

Microsoft Security

Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005

March 27, 2017 admin Advanced persistent threats, Antimalware research for IT pros and enthusiasts, Coreinfo, Creators Update, CVE-2017-005, Device Guard, EoP, PALETTE, Product features and announcements, SMEP, virtualization-based security, Windows 10, Windows 10 Creators Update, Windows Defender Advanced Threat Protection, Windows Defender ATP, zero-day exploits, ZIRCONIUM

Credit to Author: msft-mmpc| Date: Mon, 27 Mar 2017 15:00:01 +0000

On March 14, 2017, Microsoft released security bulletin MS17-013 to address CVE-2017-0005, a vulnerability in the Windows Win32k component that could potentially allow elevation of privileges. A report from a trusted partner identified a zero-day exploit for this vulnerability. The exploit targeted older versions of Windows and allowed attackers to elevate process privileges on these platforms. In this article, we…

Microsoft Security

Tax-themed phishing and malware attacks proliferate during the tax filing season

March 20, 2017 admin Antimalware research for IT pros and enthusiasts, Macro-based malware, phishing, Social engineering, spam, tax-themed attacks, Windows 10

Credit to Author: msft-mmpc| Date: Mon, 20 Mar 2017 12:50:12 +0000

Tax-themed scams and social engineering attacks are as certain as (death or) tax itself. Every year we see these attacks, and 2017 is no different. These attacks circulate year-round as cybercriminals take advantage of the different country and region tax schedules, but they peak in the months leading to U.S. Tax Day in mid-April. Cybercriminals are using a variety of…

Microsoft Security

Ransomware operators are hiding malware deeper in installer packages

March 15, 2017 admin Antimalware research for IT pros and enthusiasts, Cerber, Locky, NSIS installers, ransomware, Windows 10, Windows Defender

Credit to Author: msft-mmpc| Date: Thu, 16 Mar 2017 03:15:46 +0000

We are seeing a wave of new NSIS installers used in ransomware campaigns. These new installers pack significant updates, indicating a collective move by attackers to once again dodge AV detection by changing the way they package malicious code. These changes are observed in installers that drop ransomware like Cerber, Locky, and others. Cybercriminals have…

Microsoft Security

Uncovering cross-process injection with Windows Defender ATP

March 8, 2017 admin Advanced persistent threats, Antimalware research for IT pros and enthusiasts, APTs, bitcoin, CoinMiner, Creators Update, cross-process injection, Exploits, Fynloski RAT, Gatak, GOLD activity group, in-memory attacks, post-breach detection, public preview, Windows 10, Windows Defender Advanced Threat Protection, Windows Defender ATP, zero-day exploits

Credit to Author: msft-mmpc| Date: Thu, 09 Mar 2017 06:16:01 +0000

Windows Defender Advanced Threat Protection (Windows Defender ATP) is a post-breach solution that alerts security operations (SecOps) personnel about hostile activity. As the nature of attacks evolve, Windows Defender ATP must advance so that it continues to help SecOps personnel uncover and address the attacks. With increasing security investments from Microsoft—read how Windows 10 continues to raise…

← Previous