Microsoft Defender ATP – Page 4 – Computer Security Articles

Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack

July 8, 2019 admin AI and machine learning, Antimalware Scan Interface (AMSI), Astaroth, behavior monitoring, Command-line scanning, cybersecurity, Endpoint security, Execution stage, fileless, fileless malware, heuristics, Initial access stage, living-off-the-land, Microsoft Defender ATP, Security Intelligence, Threat protection, Windows Defender Antivirus, Windows Security, WMIC

Credit to Author: Eric Avena| Date: Mon, 08 Jul 2019 16:00:51 +0000

Advanced technologies in Microsoft Defender ATP next-generation protection exposed and defeated a widespread fileless campaign that completely “lived off the land” throughout a complex attack chain that run the info-stealing backdoor Astaroth directly in memory

The post Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack appeared first on Microsoft Security .

Microsoft Security

Microsoft’s Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time

July 2, 2019 admin cybersecurity, Endpoint security, Microsoft Defender ATP, Security Intelligence, Threat and Vulnerability Management, Threat protection, TVM, Windows Security

Credit to Author: Eric Avena| Date: Tue, 02 Jul 2019 16:00:13 +0000

I’m excited to announce that Microsoft’s Threat & Vulnerability Management solution is generally available as of June 28! We have been working closely with customers for more than a year to incorporate their real needs and feedback to better address vulnerability management. Our goal is to empower defenders with the tools they need to better…

The post Microsoft’s Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time appeared first on Microsoft Security .

Microsoft Security

Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection

June 25, 2019 admin AI and machine learning, Antimalware Scan Interface (AMSI), behavior monitoring, behavior-based machine learning, cybersecurity, Endpoint security, heuristics, machine learning, memory scanning, Microsoft Defender ATP, next-generation protections, Threat protection, Windows Defender Antivirus, Windows Security

Credit to Author: Eric Avena| Date: Mon, 24 Jun 2019 15:00:55 +0000

While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Multiple next-generation protection engines to detect and stop a wide range of threats and attacker techniques at multiple points, providing industry-best detection and blocking capabilities.

The post Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection appeared first on Microsoft Security .

Microsoft Security

New browser extensions for integrating Microsoft’s hardware-based isolation

May 24, 2019 admin browser extension, cybersecurity, Endpoint security, Google Chrome, hardware-based isolation, Microsoft Defender ATP, Microsoft Edge, mozilla firefox, phishing, platform security, Threat protection, Windows 10, Windows Defender Application Guard, Windows Security

Credit to Author: Eric Avena| Date: Thu, 23 May 2019 15:50:07 +0000

The hardware-based isolation technology on Windows 10 that allows Microsoft Edge to isolate browser-based attacks is now available as a browser extension for Google Chrome and Mozilla Firefox. We introduced the container technology in 2017. Since then, we have been evolving the technology and engaging with customers to understand how hardware-based isolation can best help…

The post New browser extensions for integrating Microsoft’s hardware-based isolation appeared first on Microsoft Security .

Microsoft Security

Detecting credential theft through memory access modelling with Microsoft Defender ATP

May 24, 2019 admin credential dumping, credential theft, cybersecurity, Endpoint security, fileless, in-memory attacks, lateral movement, living-off-the-land, LSASS, lsass.exe, memory access modelling, Microsoft Defender ATP, Reflective DLL loading, Targeted Attacks, Windows Security

Credit to Author: Eric Avena| Date: Thu, 09 May 2019 17:29:45 +0000

Microsoft Defender ATP instruments memory-related function calls such as VirtualAlloc and VirtualProtect to catch in-memory attack techniques like reflective DLL loading. The same signals can also be used to generically detect malicious credential dumping activities performed by a wide range of different individual tools.

The post Detecting credential theft through memory access modelling with Microsoft Defender ATP appeared first on Microsoft Security .

Microsoft Security

From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw

April 8, 2019 admin Blue Hat, cybersecurity, DoublePulsar, Endpoint security, exploit, kernel driver, kernel sensors, kernel-mode attacks, Microsoft Defender ATP, privlege escalation, responsible vulnerability disclosure, Vulnerability, Windows Defender ATP

Credit to Author: Eric Avena| Date: Mon, 25 Mar 2019 15:00:07 +0000

Our discovery of two privilege escalation vulnerabilities in a driver highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.

The post From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw appeared first on Microsoft Security .

Microsoft Security

Announcing Microsoft Defender ATP for Mac and new Threat and Vulnerability Management capabilities

April 8, 2019 admin Endpoint security, Microsoft Defender ATP, Microsoft Intune, Office 365 ATP, System Center Endpoint Protection (SCEP), Threat and Vulnerability Management, Threat protection

Credit to Author: Todd VanderArk| Date: Thu, 21 Mar 2019 07:00:12 +0000

Today at Ignite Amsterdam, we’re excited to announce two additions to our endpoint security platform.

The post Announcing Microsoft Defender ATP for Mac and new Threat and Vulnerability Management capabilities appeared first on Microsoft Security .