Microsoft Defender for Endpoint News and Insights

Research

Threat intelligence

Microsoft Defender

Business email compromise
Published Jun 8

12 minutes
Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
Microsoft Defender Experts observed a multi-stage adversary-in-the-middle (AiTM) and business email compromise (BEC) attack targeting banking and financial services organizations over two days. This attack originated from a compromised trusted vendor, involved AiTM and BEC attacks across multiple supplier/partner organizations for financial fraud, and did not use a reverse proxy like typical AiTM attacks.
Research

Threat intelligence

Microsoft Defender for Endpoint

Vulnerabilities and exploits
Published May 30

10 minutes
New macOS vulnerability, Migraine, could bypass System Integrity Protection
A new vulnerability, which we refer to as “Migraine”, could allow an attacker with root access to bypass System Integrity Protection (SIP) in macOS and perform arbitrary operations on a device.
Research

Incident response

Microsoft Defender

Attacker techniques, tools, and infrastructure
Published Mar 24

17 minutes
Guidance for investigating attacks using CVE-2023-23397
This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397.
News

Analyst reports

Microsoft Defender
Published Mar 2

4 minutes
Microsoft is named a Leader in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms
Gartner has again recognized Microsoft as a Leader in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms, positioned highest on the Ability to Execute.
Best practices

MISA

Microsoft Defender
Published Feb 14

9 minutes
Addressing cybersecurity at the board level with Difenda and Microsoft
Learn how business leaders can utilize managed extended detection and response, powered by the Microsoft Security product portfolio, to make informed decisions and prioritize investments in cybersecurity at the board level.

Tailored AI insights from Microsoft Security Copilot

Empower your defenders to detect hidden patterns, harden defenses, and respond to incidents faster with generative AI.

Research

Threat intelligence

Microsoft Defender

Vulnerabilities and exploits
Published Dec 19

9 minutes
Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability
Microsoft discovered a vulnerability in macOS, referred to as “Achilles”, allowing attackers to bypass application execution restrictions enforced by the Gatekeeper security mechanism.
Research

Threat intelligence

Microsoft Defender

Supply chain attacks
Published Nov 22

6 minutes
Vulnerable SDK components lead to supply chain risks in IoT and OT environments
As vulnerabilities in network components, architecture files, and developer tools have become an increasingly popular attack vector to leverage access into secure networks and devices, Microsoft identified such a vulnerable component and found evidence of a supply chain risk that might affect millions of organizations and devices.
Research

Threat intelligence

Microsoft Defender

Ransomware
Published Nov 3

6 minutes
Stopping C2 communications in human-operated ransomware through network protection
Providing advanced protection against increasingly sophisticated human-operated ransomware, Microsoft Defender for Endpoint’s network protection leverages threat intelligence and machine learning to block command-and-control (C2) communications.
News

Cloud security

Microsoft Defender
Published Oct 24

6 minutes
Secure your endpoints with Transparity and Microsoft
When it comes to cybersecurity, the ability to normalize and correlate disparate logs from different devices, appliances, and resources is key, as is the ability to react quickly when under attack. In this blog post, we explore the importance of EPP as an essential component in your security strategy.

Modernize your Security Operations Center with Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM solution powered by AI and automation that delivers intelligent security analytics across your entire enterprise.

Learn more

Research

Threat intelligence

Microsoft Defender

IoT / OT threats
Published Oct 21

4 minutes
Securing IoT devices against attacks that target critical infrastructure
South Staffordshire PLC, a company that supplies water to over one million customers in the United Kingdom, notified its customers in August of being a target of a criminal cyberattack. This incident highlights the sophisticated threats that critical industries face today. According to South Staffordshire, the breach did not appear to have caused damage to […]