Windows SmartScreen Exploit Paves the Way for Phemedrone Stealer

Summary: The Phemedrone stealer malware campaign exploits a vulnerability in Microsoft Defender SmartScreen. Phemedrone, an open-source information-stealing malware written in C, is designed to extract data from web browsers, and cryptocurrency wallets. Threat Level - Red | Attack Report For a...

Unified security operations with Microsoft Sentinel and Microsoft Defender XDR

Numerous cybersecurity tools exist to help organizations protect their data, people, and systems. There are different tools that check emails for phishing attempts, secure infrastructure and cloud, and provide generative AI to detect threats and uplevel response beyond human ability. While each o...

Qualys and Microsoft Sunset Embedded Integration of Qualys Solutions for Microsoft Defender for Cloud

Qualys offers a holistic risk-based approach to securing modern cloud workloads Over the past three years, Qualys has had a strong collaboration with Microsoft, with Qualys providing the vulnerability assessment engine for Microsoft Defender for Cloud, covering infrastructure and container...

The vulnerability of the Microsoft Defender software arises from insufficient validation of input data, allowing a perpetrator to trigger a service failure.

The vulnerability of the Microsoft Defender software exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures using specially crafted input data...

CVE-2023-36010

Microsoft Defender Denial of Service Vulnerability...

CVE-2023-36010

Microsoft Defender Denial of Service Vulnerability...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

December 12, 2023—KB5033371 (OS Build 17763.5206) - EXPIRED

None None...

December 12, 2023—KB5033369 (OS Build 22000.2652)

None None...

Microsoft Defender Security Vulnerability

Microsoft Defender is a threat protection software from Microsoft USA. A security vulnerability exists in Microsoft Defender. An attacker has exploited the vulnerability to cause a denial of service on the system...

PT-2023-8028

Name of the Vulnerable Software and Affected Versions Microsoft Defender affected versions not specified Description The issue is due to insufficient input validation in Microsoft Defender. An attacker can exploit this to cause a denial of service using specially crafted input. Recommendations At...

Microsoft Security Copilot drives new product integrations at Microsoft Ignite to empower security and IT teams

First announced in March 2023, Microsoft Security Copilot—Microsofts first generative AI security product—has sparked major interest. The widespread enthusiasm was on full display after announcing our Early Access Program in October 2023 and sharing our incredible Security Copilot innovations at...

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet ZINC involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitima...

Security Updates for Windows Defender (November 2023)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to 4.18.23100.2009. It is, therefore, affected by a privilege escalation vulnerability. An authenticated attacker can exploit this to gain elevated privileges. Note that Nessus has no...

Forrester names Microsoft a Leader in the 2023 Endpoint Security Wave™ report

We are excited to share that Microsoft has been named a Leader in The Forrester Wave™: Endpoint Security, Q4 2023. Microsoft received the highest possible scores in the strategy category for the vision and roadmap criteria. Forrester notes, “Microsoft’s outstanding roadmap for endpoint security...

Microsoft Defender Thwarts Large-Scale Akira Ransomware Attack

Microsoft on Wednesday said that a user containment feature in Microsoft Defender for Endpoint helped thwart a "large-scale remote encryption attempt" made by Akira ransomware actors targeting an unknown industrial organization in early June 2023. The tech giant's threat intelligence team is...

Automatic disruption of human-operated attacks through containment of compromised user accounts

Our experience and insights from real-world incidents tell us that the swift containment of compromised user accounts is key to disrupting hands-on-keyboard attacks, especially those that involve human-operated ransomware. In these attacks, lateral movement follows initial access as the next...

Microsoft Defender for Endpoint now stops human-operated attacks on its own

Defenders need every edge they can get in the fight against ransomware. Today, were pleased to announce that Microsoft Defender for Endpoint customers will now be able automatically to disrupt human-operated attacks like ransomware early in the kill chain without needing to deploy any other...

Defending new vectors: Threat actors attempt SQL Server to cloud lateral movement

Microsoft security researchers recently identified a campaign where attackers attempted to move laterally to a cloud environment through a SQL Server instance. This attack technique demonstrates an approach weve seen in other cloud services such as VMs and Kubernetes cluster, but not in SQL Serve...