Author: Microsoft Defender ATP Research Team

Featured image for Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.
Read more Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning
Featured image for Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection

Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection

Learn how we're using deep learning to build a powerful, high-precision classification model for long sequences of wide-ranging signals occurring at different times.
Read more Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection
Featured image for Defending Exchange servers under attack

Defending Exchange servers under attack

Exchange servers are high-value targets. These attacks also tend to be advanced threats with highly evasive, fileless techniques. Keeping these servers safe from these advanced attacks is of utmost importance.
Read more Defending Exchange servers under attack
Featured image for Latest Astaroth living-off-the-land attacks are even more invisible but not less observable

Latest Astaroth living-off-the-land attacks are even more invisible but not less observable

Astaroth is back sporting significant changes. The updated attack chain maintains Astaroth’s complex, multi-component nature and continues its pattern of detection evasion.
Read more Latest Astaroth living-off-the-land attacks are even more invisible but not less observable
Worker behind a desk. Featured image for Behavioral blocking and containment: Transforming optics into protection

Behavioral blocking and containment: Transforming optics into protection

Behavioral blocking and containment capabilities leverage multiple Microsoft Defender ATP components and features to immediately stop attacks before they can progress. We have expanded these capabilities to get even broader visibility into malicious behavior by using a rapid protection loop engine that leverages endpoint and detection response (EDR) sensors.
Read more Behavioral blocking and containment: Transforming optics into protection
Featured image for Ghost in the shell: Investigating web shell attacks

Ghost in the shell: Investigating web shell attacks

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
Read more Ghost in the shell: Investigating web shell attacks
Featured image for sLoad launches version 2.0, Starslord

sLoad launches version 2.0, Starslord

sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine.
Read more sLoad launches version 2.0, Starslord
Featured image for Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats.
Read more Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities

Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain. The PowerShell-based downloader Trojan known as sLoad, however, puts all its bets on BITS.
Read more Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities
Featured image for Insights from one year of tracking a polymorphic threat

Insights from one year of tracking a polymorphic threat

We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in general.
Read more Insights from one year of tracking a polymorphic threat