Secure unmanaged devices with Microsoft Defender for Endpoint now

As we have entered into new hybrid work environments, businesses need to think about how they will proactively protect their organizations from the influx of new or “bring your own” BYO connected devices. This new normal has exposed the most challenging cybersecurity landscape we’ve ever...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

DefenderCheck - Identifies The Bytes That Microsoft Defender Flags On

Quick tool to help make evasion work a little bit easier. Takes a binary as input and splits it until it pinpoints that exact byte that Microsoft Defender will flag on, and then prints those offending bytes to the screen. This can be helpful when trying to identify the specific bad pieces of code...

Automatic on-premises Exchange Server mitigation now in Microsoft Defender Antivirus

As cybercriminals continue to exploit unpatched on-premises versions of Exchange Server 2013, 2016, and 2019, we continue to actively work with customers and partners to help them secure their environments and respond to associated threats. To date, we have released a comprehensive Security Updat...

Automatic on-premises Exchange Server mitigation now in Microsoft Defender Antivirus

As cybercriminals continue to exploit unpatched on-premises versions of Exchange Server 2013, 2016, and 2019, we continue to actively work with customers and partners to help them secure their environments and respond to associated threats. To date, we have released a comprehensive Security Updat...

XLM + AMSI: New runtime defense against Excel 4.0 macro malware

We have recently expanded the integration of Antimalware Scan Interface AMSI with Office 365 to include the runtime scanning of Excel 4.0 XLM macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros. This integration, an example of the many security feature...

HAFNIUM targeting Exchange Servers with 0-day exploits

Update 03/08/2021: Microsoft continues to see multiple actors taking advantage of unpatched systems to attack organizations with on-premises Exchange Server. To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed ...

CVE-2021-24092

Microsoft Defender Elevation of Privilege Vulnerability...

CVE-2021-24092

Microsoft Defender Elevation of Privilege Vulnerability...

CVE-2021-24092

Microsoft Defender Elevation of Privilege Vulnerability...

Privilege escalation

Microsoft Defender Elevation of Privilege Vulnerability...

CVE-2021-24092 Microsoft Defender Elevation of Privilege Vulnerability

...

What we like about Microsoft Defender for Endpoint

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. It’s no secret that the security industry generally likes Microsoft Defender for Endpoint. After a few months of using and integrating it with our platform here at Expel, we feel the...

What we like about Microsoft Defender for Endpoint

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. It’s no secret that the security industry generally likes Microsoft Defender for Endpoint. After a few months of using and integrating it with our platform here at Expel, we feel the...

Microsoft Defender Elevation of Privilege Vulnerability

...

Microsoft Defender Security Feature Issue Vulnerability

Microsoft Defender is a threat protection software from Microsoft Corporation USA. A security feature issue vulnerability exists in Microsoft Defender. The following products and versions are affected: Microsoft Endpoint Protection,Microsoft System Center Endpoint Protection,Microsoft System Cent...

PT-2021-2082 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft Defender versions prior to the fixed version Description: The issue is related to errors in privilege management in Microsoft Defender, which is part of the Microsoft Windows operating system. Exploitation of this issue may allow an...

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

From March to December 2020, we tracked segments of a dynamically generated email infrastructure that attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics. These...

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

From March to December 2020, we tracked segments of a dynamically generated email infrastructure that attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics. These...