Microsoft Threat Intelligence, Author at Microsoft Security Blog

Research
May 8, 2020
4 min read

Microsoft researchers work with Intel Labs to explore new deep learning approaches for malware classification

Researchers from Microsoft Threat Protection Intelligence Team and Intel Labs collaborated to study the application of deep transfer learning technique from computer vision to static malware classification.

Research
April 28, 2020
13 min read

Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk

Multiple ransomware groups that have been accumulating access and maintaining persistence on target networks for several months activated dozens of ransomware deployments in the first two weeks of April 2020.

Research
April 1, 2020
5 min read

Microsoft works with healthcare organizations to protect from popular ransomware during COVID-19 crisis: Here’s what to do

Microsoft identified several dozens of hospitals with vulnerable gateway and VPN appliances.

Research
March 5, 2020
19 min read

Human-operated ransomware attacks: A preventable disaster

In human-operated ransomware attacks, adversaries exhibit extensive knowledge of systems administration and common network security misconfigurations, perform thorough reconnaissance, and adapt to what they discover in a compromised network.

Research
February 4, 2020
5 min read

Ghost in the shell: Investigating web shell attacks

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.

Research
December 12, 2019
9 min read

GALLIUM: Targeting global telecom

Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers.

Research
December 11, 2019
6 min read

The quiet evolution of phishing

In 2019, we saw phishing attacks reach new levels of creativity and sophistication.

Research
September 3, 2019
6 min read

Deep learning rises: New methods for detecting malicious PowerShell

We adopted a deep learning technique that was initially developed for natural language processing and applied to expand Microsoft Defender ATP’s coverage of detecting malicious PowerShell scripts, which continue to be a critical attack vector.

A tech worker using a dual screen PC workstation.

Research
May 9, 2019
3 min read

Detecting credential theft through memory access modelling with Microsoft Defender ATP

Microsoft Defender ATP instruments memory-related function calls such as VirtualAlloc and VirtualProtect to catch in-memory attack techniques like reflective DLL loading.

A group of tech workers checking out some suspicious code.

Research
April 10, 2019
9 min read

Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability

A complex attack chain incorporating the CVE-2018-20250 exploit and multiple code execution techniques attempted to run a fileless PowerShell backdoor that could allow an adversary to take full control of compromised machines.

Customers can partner with Microsoft security experts, who can be engaged directly from within Microsoft Defender Security Center.

Research
February 28, 2019
3 min read

Announcing Microsoft Threat Experts

Microsoft Threat Experts is a new managed threat hunting service in Windows Defender Advanced Threat Protection.

Research
February 22, 2019
5 min read

Recommendations for deploying the latest Attack surface reduction rules for maximum impact

Attack surface reduction is a technique to remove or constrain exploitable behaviors in your systems.

Microsoft Threat Intelligence posts