behavioral blocking and containment Archives - ThreatsHub Cybersecurity News

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

August 27, 2020 TH Author Active Directory attacks, Antimalware Scan Interface (AMSI), behavioral blocking and containment, BloodHound, Cybersecurity, Endpoint security, Kerberoasting, machine learning, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft security intelligence, post-exploitation, Threat protection

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.
The post Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Defending Exchange servers under attack

June 24, 2020 TH Author behavioral blocking and containment, Cybersecurity, Exchange Server, fileless, living-off-the-land, Microsoft security intelligence, Threat protection, web shell

Exchange servers are high-value targets. These attacks also tend to be advanced threats with highly evasive, fileless techniques. Keeping these servers safe from these advanced attacks is of utmost importance.
The post Defending Exchange servers under attack appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Latest Astaroth living-off-the-land attacks are even more invisible but not less observable

March 23, 2020 TH Author Alternate Data Streams (ADS), Astaroth, behavioral blocking and containment, Cybersecurity, Endpoint security, fileless, info-stealing malware, living-off-the-land, Microsoft Defender Advanced Threat Protection, Microsoft security intelligence, ransomware, Security Intelligence, Threat protection, WMIC

Astaroth is back sporting significant changes. The updated attack chain maintains Astaroth’s complex, multi-component nature and continues its pattern of detection evasion.
The post Latest Astaroth living-off-the-land attacks are even more invisible but not less observable appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Behavioral blocking and containment: Transforming optics into protection

March 9, 2020 TH Author behavioral blocking and containment, Cybersecurity, endpoint detection and response (EDR), endpoint protection platform (EPP), Endpoint security, Juicy Potato, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft security intelligence, Microsoft Threat Protection, next generation protection, QRat, Security Intelligence, Threat protection

Behavioral blocking and containment capabilities leverage multiple Microsoft Defender ATP components and features to immediately stop attacks before they can progress. We have expanded these capabilities to get even broader visibility into malicious behavior by using a rapid protection loop engine that leverages endpoint and detection response (EDR) sensors.
The post Behavioral blocking and containment: Transforming optics into protection appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Insights from one year of tracking a polymorphic threat

November 26, 2019 TH Author behavior monitoring, behavior-based machine learning, behavioral blocking and containment, Cybersecurity, Dexphot, fileless, Microsoft security intelligence, Polymorphic malware

We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in general.
The post Insights from one year of tracking a polymorphic threat appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks

October 8, 2019 TH Author AI and machine learning, AMSI paired machine learning, Automation, behavior-based machine learning, behavioral blocking and containment, Cybersecurity, endpoint protection platform, Endpoint security, Microsoft Defender ATP, Microsoft security intelligence, Security Intelligence, threat and malware prevention

Two new machine learning protection features within the behavioral blocking and containment capabilities in Microsoft Defender ATP specialize in detecting threats by analyzing behavior, adding new layers of protection after an attack has started running.
The post In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks appeared first on Microsoft Security. READ MORE HERE…