Recommendations for deploying the latest Attack surface reduction rules for maximum impact

The keystone to good security hygiene is limiting your attack surface. Attack surface reduction is a technique to remove or constrain exploitable behaviors in your systems. In this blog, we discuss the two attack surface reduction rules introduced in the most recent release of Windows and cover...

TAU Threat Intelligence Notification: PPID Spoofing – Explorer CLSID

Summary Popular Attack Surface Reduction bypasses allow adversaries to hinder threat hunting activities by spoofing Parent Process ID. PPID to PID relationships have always been a key indicator of compromise and removing these conditions lead to false sense of security. Upon investigation its bee...

Microsoft Windows Defender AV: Block Office applications from creating executable content

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockofficeexeccontent.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block Office applications from creating executable content Authors: Emanuel Moss Copyright: Copyrig...

Microsoft Windows Defender AV: Block Office applications from injecting into other processes

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockofficeinjecting.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block Office applications from injecting into other processes Authors: Emanuel Moss Copyright:...

Microsoft Windows Defender AV: Block Office applications from creating child processes

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavofficesubprocesses.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Microsoft Windows Defender AV: Impede JavaScript and VBScript to launch executables

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavimpedejsvbsexec.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Impede JavaScript and VBScript to launch executables Authors: Emanuel Moss Copyright: Copyright c 2018...

Microsoft Windows Defender AV: Block Win32 imports from macro code in Office

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockwin32importoffice.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block Win32 imports from macro code in Office Authors: Emanuel Moss Copyright: Copyright c 2018...

Microsoft Windows Defender AV: Block executable content from email client and webmail

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockexeccontentmail.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block executable content from email client and webmail Authors: Emanuel Moss Copyright: Copyright c...

Microsoft Windows Defender AV: Block execution of potentially obfuscated scripts

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockexecobfuscatedscripts.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block execution of potentially obfuscated scripts Authors: Emanuel Moss Copyright: Copyright c...

How to mitigate rapid cyberattacks such as Petya and WannaCrypt

In the first blog post of this 3-part series, we introduced what rapid cyberattacks are and illustrated how rapid cyberattacks are different in terms of execution and outcome. In the second blog post, we provided some details on Petya and how it worked. In this final blog post, we will share:...

Microsoft Provides Guidance on Mitigating DDE Attacks

Despite a rash of attacks leveraging Dynamic Data Exchange fields in Office, including some spreading destructive ransomware, Microsoft has remained insistent that DDE is a product feature and won’t address it as a vulnerability. Microsoft on Wednesday did, however, put some guidance in admins’...

Exploit for CVE-2017-8759 detected and neutralized

The September 12, 2017 security updates from Microsoft include the patch for a previously unknown vulnerability exploited through Microsoft Word as an entry vector. Customers using Microsoft advanced threat solutions were already protected against this threat. The vulnerability, classified as...

What’s new in Windows Defender ATP Fall Creators Update

When we introduced Windows Defender Advanced Threat Protection Windows Defender ATP, our initial focus was to reduce the time it takes companies to detect, investigate, and respond to advanced attacks. The Windows Fall Creators Update represents a new chapter in our product evolution as we offer ...

System Hardening Guide

The purpose of system hardening is to eliminate as many security risks as possible. Hardening is the process of securing a system by reducing its attack surface. A system has a larger vulnerability surface the more functions it fulfills; in principle a single-function system is more secure than a...

Attackers Exploiting Windows OLE Vulnerability

Attackers are using a zero day vulnerability in nearly all supported versions of Windows in a series of targeted attacks. The flaw is in the OLE technology in Windows and can be used for remote code execution is a targeted user opens a rigged Office file. Microsoft is warning customers that there...

Microsoft Releases EMET 5.0 Exploit Mitigation Tool

The latest version of Microsoft’s freely available stopgap against zero-day exploits was released today with two new exploit mitigations and a batch of new configuration options. The update to Microsoft’s Enhanced Mitigation Experience Tool kit, or EMET, comes six months after a technical preview...

Microsoft EMET 5.0 Technical Preview Released

SAN FRANCISCO – Enterprises beat up by wave after wave of Java exploits and calls to disable the platform may soon have some relief in sight. Microsoft’s free Enhanced Mitigation Experience Toolkit will soon have a new feature that allows users to configure where plug-ins, especially those target...