Microsoft: Here’s how our technology disrupts ransomware and phishing attacks

February 24, 2023 TH Author

developers-looking-at-a-monitor-in-an-office — Image: Getty/Luis Alvarez

Microsoft is expanding its cybersecurity suite, Microsoft 365 Defender, with AI-based capabilities which can automatically detect and disrupt cyberattacks like ransomware attacks and business email compromise (BEC) campaigns by quickly identifying and switching off the accounts or services being exploited by attackers.

In Depth: These experts are racing to protect AI from hackers. Time is running out

Successfully compromising and exploiting the right accounts can allow cyber criminals to gain access to the tools and privileges they need to encrypt a whole network of machines with ransomware in a short amount of time.

Meanwhile, BEC attacks — email attacks where employees are tricked into making financial transfers under false pretexts — can also occur in a short amount of time.

Both ransomware and BEC attacks can be very costly for victims. To help protect networks from cyberattacks, Microsoft is expanding the automatic attack disruption in Microsoft 365 Defender, which is powered by artificial intelligence-driven threat hunting and detection capabilities, which were first unveiled last year.

Also: The best VPN services

This capability uses high-confidence Extended Detection and Response (XDR) signals across endpoints, identities, email, and SaaS (Software as a Service) apps, to contain cybersecurity attacks quickly and effectively, to stop attacks and limit the impact to the victim.

Microsoft is expanding its public preview of Microsoft 365 Defender, to help protect networks against ransomware and BEC attacks, two of the most common — and most costly — cybersecurity threats to businesses.

To prevent BEC attacks, automatic attack disruption detects attacks and removes the attacker’s access to the environment by switching off the compromised account, therefore limiting their ability to send fraudulent emails, preventing money transfers and financial losses.

Meanwhile to prevent ransomware attacks, it will isolate suspicious activity from a compromised device to prevent an attacker from using it to gain access to other machines and services which can be abused to spread the malicious payload.

Also: The ransomware problem isn’t going away, and these grim figures prove it

To ensure that the system isn’t actively quarantining false positives — and hindering legitimate users — Microsoft 365 Defender is trained with endpoint detection and response signals, along with insights from the continuous investigation of thousands of incidents by Microsoft’s research teams.

Action will only be taken if the activity has been properly examined by the AI powering the tool and, if it’s concluded that the activity is malicious, the automatic response actions are triggered against entities identified as compromised — preventing further attacks.

“This game-changing capability comes built-in with Microsoft 365 Defender and limits a threat actor’s progress early on – reducing the overall impact of an attack, from associated costs to loss of productivity,” said Eyal Haik, senior product manager at Microsoft.