Microsoft Released Out-of-Band Security Updates – How to Detect and Remediate

Microsoft released an out-of-band update yesterday that fixes two critical vulnerabilities - The Internet Explorer remote code execution vulnerability CVE-2019-1367 and Microsoft Defender Denial of Service Vulnerability CVE-2019-1255. According to the Microsoft advisory CVE-2019-1367, the Interne...

Microsoft Releases Emergency Patches for IE 0-Day and Windows Defender Flaw

It's not a Patch Tuesday, but Microsoft is rolling out emergency out-of-band security patches for two new vulnerabilities, one of which is a critical Internet Explorer zero-day that cyber criminals are actively exploiting in the wild. Discovered by Clément Lecigne of Google's Threat Analysis Grou...

Microsoft Defender DoS Vulnerability (Sep 2019)

This host is missing an important security update according to Microsoft Security Updates released for Microsoft Malware Protection Engine dated 23-09-2019 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Microsoft Internet Explorer Zero-Day Flaw Addressed in Out-of-Band Security Update

Microsoft has released out-of-band security updates addressing two vulnerabilities – including an Internet Explorer zero-day vulnerability being actively exploited in the wild. The Internet Explorer zero-day vulnerability CVE-2019-1367 is a remote code execution flaw that could enable an attacker...

CVE-2019-1255

A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'...

CVE-2019-1255

A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'...

Denial of service

A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'...

CVE-2019-1255

A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'...

Microsoft Defender Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Defender improperly handles files. An attacker could exploit the vulnerability to overwrite the discretionary access control list DACL for a file. To exploit the vulnerability, an attacker would first require execution on the victim...

Deep learning rises: New methods for detecting malicious PowerShell

Scientific and technological advancements in deep learning, a category of algorithms within the larger framework of machine learning, provide new opportunities for development of state-of-the art protection technologies. Deep learning methods are impressively outperforming traditional methods on...

Microsoft Defender Elevation of Privilege Vulnerability (CVE-2019-1161)

The version of Microsoft Malware Protection Signature Update Stub MpSigStub.exe installed on the remote Windows host is prior to 1.1.16200.1. It is, therefore, affected by a elevation of privilege vulnerability which could allow an attacker who successfully exploited this vulnerability to elevate...

CVE-2019-1161

Summary: CVE-2019-1161 is a privilege-escalation flaw in Microsoft Defender’s MpSigStub.exe that can enable an attacker to delete protected files at arbitrary locations. What is affected: Defender-related components using MpSigStub.exe (e.g., Windows Defender/Forefront Endpoint Protection suites)...

KLA11537 Privilege escalation vulnerability in Microsoft Defender

An elevation of privilege vulnerability was found in Microsoft Defender. Malicious users can exploit this vulnerability via specially crafted command to gain privileges. Original advisories CVE-2019-1161 Related products Windows-Defender CVE list CVE-2019-1161 high KB list Solution Install...

How Windows Defender Antivirus integrates hardware-based system integrity for informed, extensive endpoint protection

Detecting and stopping attacks that tamper with kernel-mode agents at the hypervisor level is a critical component of the unified endpoint protection platform in Microsoft Defender Advanced Threat Protection Microsoft Defender ATP. It’s not without challenges, but the deep integration of Windows...

New machine learning model sifts through the good to unearth the bad in evasive malware

We continuously harden machine learning protections against evasion and adversarial attacks. One of the latest innovations in our protection technology is the addition of a class of hardened malware detection machine learning models called monotonic models to Microsoft Defender ATP's Antivirus...

Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack

The prevailing perception about fileless threats, among the security industry’s biggest areas of concern today, is that security solutions are helpless against these supposedly invincible threats. Because fileless attacks run the payload directly in memory or leverage legitimate system tools to r...

Microsoft’s Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time

I'm excited to announce that Microsoft’s Threat & Vulnerability Management solution is generally available as of June 30! We have been working closely with customers for more than a year to incorporate their real needs and feedback to better address vulnerability management. Our goal is to empowe...

Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection

While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Windows Defender Antivirus is the next-generation protection component of Microsoft Defender Advance...

Step 9. Protect your OS: top 10 actions to secure your environment

In “Step 9. Protect your OS” of the Top 10 actions to secure your environment blog series, we provide resources to help you configure Microsoft Defender Advanced Threat Protection Microsoft Defender ATP to defend your Windows, macOS, Linux, iOS, and Android devices from advanced threats. In an...

Detecting credential theft through memory access modelling with Microsoft Defender ATP

Stealing user credentials is a key step for attackers to move laterally across victim networks. In today’s attacks, we see a range of tools used to achieve credential theft, requiring protections that target the root behavior and not just individual known tools as is often done by traditional...