Image of two coworkers collaborating at a desk.

Microsoft Detection and Response Team (DART)

A blog series focused on the latest attack methods as well as cybersecurity best practices derived from our investigations and engagements, helping our customers respond to compromises and become cyber-resilient.

Man in a collared shirt working on a server station inside a secure room. Coworkers and large monitors are in the background. Keywords: network security, on-premise security, threat protection, secure score, monitoring, security management, operations, Microsoft Security collection Featured image for Advice for incident responders on recovery from systemic identity compromises

Advice for incident responders on recovery from systemic identity compromises

Customers across the globe are asking for guidance on recovering their infrastructure after being impacted by Solorigate. DART walks you through remediation steps as well as some longer term mitigations.
Read more Advice for incident responders on recovery from systemic identity compromises
IT professional at a digital consulting firm. Featured image for A “quick wins” approach to securing Azure Active Directory and Office 365 and improving your security posture

A “quick wins” approach to securing Azure Active Directory and Office 365 and improving your security posture

This blog post will explain simple Microsoft security defaults and Secure Score—two features you should take advantage of that are easy to utilize and can significantly improve security in Azure AD and Office 365 configurations.
Read more A “quick wins” approach to securing Azure Active Directory and Office 365 and improving your security posture
image of a man walking through a State-of-the-art facility uses eco-friendly solutions such as using reclaimed water to cool the data center. Featured image for Best practices for defending Azure Virtual Machines

Best practices for defending Azure Virtual Machines

One of the things that our Detection and Response Team (DART) and Customer Service and Support (CSS) security teams see frequently during investigation of customer incidents are attacks on virtual machines from the internet. This is one area in the cloud security shared responsibility model where customer tenants are responsible for security. Security is a…
Read more Best practices for defending Azure Virtual Machines
An image of a woman wearing a dark shirt in a dim office scrolling or working on a Microsoft Surface Studio. Featured image for Microsoft Office 365—Do you have a false sense of cloud security?

Microsoft Office 365—Do you have a false sense of cloud security?

Security is not just flipping the switch of security features to "on" and think you are done. DART explores the concept of having a false sense of security when securing your cloud environments.
Read more Microsoft Office 365—Do you have a false sense of cloud security?
Real people, real offices. Featured image for CISO Series: Lessons learned from the Microsoft SOC—Part 3c: A day in the life part 2

CISO Series: Lessons learned from the Microsoft SOC—Part 3c: A day in the life part 2

This blog wraps up the day in the life of a SOC analyst on the investigation team with insights on remediating incidents, post-incident cleanup, and impact of COVID-19 on the SOC. This is the sixth blog post in the series.
Read more CISO Series: Lessons learned from the Microsoft SOC—Part 3c: A day in the life part 2
Designer image whose text reads "Polymorphic." Featured image for Full Operational Shutdown—another cybercrime case from the Microsoft Detection and Response Team

Full Operational Shutdown—another cybercrime case from the Microsoft Detection and Response Team

Today, we're glad to share DART Case Report 002—Full Operational Shutdown.
Read more Full Operational Shutdown—another cybercrime case from the Microsoft Detection and Response Team
Featured image for Real-life cybercrime stories from DART, the Microsoft Detection and Response Team

Real-life cybercrime stories from DART, the Microsoft Detection and Response Team

In the new DART Case Reports, you'll find unique stories from our team’s engagements around the globe. Read the first in the series today.
Read more Real-life cybercrime stories from DART, the Microsoft Detection and Response Team
Featured image for Ghost in the shell: Investigating web shell attacks

Ghost in the shell: Investigating web shell attacks

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
Read more Ghost in the shell: Investigating web shell attacks
A woman in a car types on her laptop. Featured image for Threat hunting in Azure Advanced Threat Protection (ATP)

Threat hunting in Azure Advanced Threat Protection (ATP)

DART was called into an engagement where the adversary had a foothold within the on-premises network, which had been gained through compromising cloud credentials. Luckily, this customer had deployed Azure ATP prior to the incident and it had already normalized authentication and identity transactions within the customer network.
Read more Threat hunting in Azure Advanced Threat Protection (ATP)

Norsk Hydro responds to ransomware attack with transparency

Aluminum supplier Norsk Hydro was attacked by LockerGoga, a form of ransomware. Learn how the company recovered and got back to business as usual.
Read more Norsk Hydro responds to ransomware attack with transparency
Image of two workers in an office looking at their laptops. Featured image for Ransomware response—to pay or not to pay?

Ransomware response—to pay or not to pay?

As part of Microsoft’s Detection and Response Team (DART) Incident Response engagements, we regularly get asked by customers about "paying the ransom" following a ransomware attack.
Read more Ransomware response—to pay or not to pay?
Image of a man walking through a datacenter. Featured image for Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1

Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1

A series on DART’s tools, techniques, and procedures for investigating cybersecurity incidents at their customer organizations. Part 1 introduces the team and gives a brief overview of the tools that DART utilizes.
Read more Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1