Microsoft Defender Security Research Team, Author at Microsoft Security Blog

CISO (chief information security officer) collaborating with practitioners in a security operations center.

News
July 16
7 min read

Protecting customers from Octo Tempest attacks across multiple industries

To help protect and inform customers, Microsoft highlights protection coverage across the Microsoft Defender security ecosystem to protect against threat actors like Octo Tempest.

Cybersecurity
August 27, 2020
6 min read

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.

Cybersecurity
July 23, 2020
11 min read

Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection

Learn how we’re using deep learning to build a powerful, high-precision classification model for long sequences of wide-ranging signals occurring at different times.

Cybersecurity
June 24, 2020
12 min read

Defending Exchange servers under attack

Exchange servers are high-value targets.

Cybersecurity
March 23, 2020
6 min read

Latest Astaroth living-off-the-land attacks are even more invisible but not less observable

Astaroth is back sporting significant changes.

Cybersecurity
March 9, 2020
6 min read

Behavioral blocking and containment: Transforming optics into protection

Behavioral blocking and containment capabilities leverage multiple Microsoft Defender ATP components and features to immediately stop attacks before they can progress.

Cybersecurity
January 21, 2020
5 min read

sLoad launches version 2.0, Starslord

sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine.

Cybersecurity
December 18, 2019
13 min read

Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats.

Cybersecurity
December 12, 2019
8 min read

Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities

Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain.

Cybersecurity
November 26, 2019
10 min read

Insights from one year of tracking a polymorphic threat

We discovered the polymoprhic threat Dexphot in October 2018.

Cybersecurity
November 7, 2019
4 min read

Microsoft works with researchers to detect and protect against new RDP exploits

The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check.

Cybersecurity
October 8, 2019
8 min read

In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks

Two new machine learning protection features within the behavioral blocking and containment capabilities in Microsoft Defender ATP specialize in detecting threats by analyzing behavior, adding new layers of protection after an attack has started running.

Microsoft Defender Security Research Team posts