Microsoft security intelligence

Security research, threat intelligence, and Microsoft Threat Protection news.

Featured image for Industry-wide partnership on threat-informed defense improves security for all

Industry-wide partnership on threat-informed defense improves security for all

MITRE Engenuity’s Center for Threat-Informed Defense has published a library of detailed plans for emulating the threat actor FIN6 (which Microsoft tracks as TAAL). Microsoft is proud to be part of this industry-wide collaborative project.
Read more Industry-wide partnership on threat-informed defense improves security for all
An image of a woman sitting at a PC work station. Featured image for Microsoft announces new Project OneFuzz framework, an open source developer tool to find and fix bugs at scale

Microsoft announces new Project OneFuzz framework, an open source developer tool to find and fix bugs at scale

We're excited to release a new tool called OneFuzz, an extensible fuzz testing framework for Azure.
Read more Microsoft announces new Project OneFuzz framework, an open source developer tool to find and fix bugs at scale
Featured image for Force firmware code to be measured and attested by Secure Launch on Windows 10

Force firmware code to be measured and attested by Secure Launch on Windows 10

For important security features on Windows to properly do their jobs, the platform’s firmware and hardware must be trustworthy and healthy. Learn about Secure Launch, which leverages the principle of Dynamic Root of Trust for Measurement (DRTM), and System Management Mode (SMM) protection.
Read more Force firmware code to be measured and attested by Secure Launch on Windows 10
Featured image for Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.
Read more Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning
Featured image for Inside Microsoft Threat Protection: Solving cross-domain security incidents through the power of correlation analytics

Inside Microsoft Threat Protection: Solving cross-domain security incidents through the power of correlation analytics

Through deep correlation logic, Microsoft Threat Protection automatically finds links between related signals across domains. It connects related existing alerts and generates additional alerts where suspicious events that could otherwise be missed can be detected.
Read more Inside Microsoft Threat Protection: Solving cross-domain security incidents through the power of correlation analytics
Featured image for Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection

Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection

Learn how we're using deep learning to build a powerful, high-precision classification model for long sequences of wide-ranging signals occurring at different times.
Read more Seeing the big picture: Deep learning-based fusion of behavior signals for threat detection
Featured image for Inside Microsoft Threat Protection: Correlating and consolidating attacks into incidents

Inside Microsoft Threat Protection: Correlating and consolidating attacks into incidents

The incidents view in Microsoft Threat Protection empowers SOC analysts by automatically fusing attack evidence and providing a consolidated view of an attack chain and affected assets, as well as a single-click remediation with easy-to-read analyst workflows.
Read more Inside Microsoft Threat Protection: Correlating and consolidating attacks into incidents
Featured image for Introducing Kernel Data Protection, a new platform security technology for preventing data corruption

Introducing Kernel Data Protection, a new platform security technology for preventing data corruption

Kernel Data Protection (KDP) is a set of APIs that provide the ability to mark some kernel memory as read-only, preventing attackers from ever modifying protected memory.
Read more Introducing Kernel Data Protection, a new platform security technology for preventing data corruption
Featured image for Defending Exchange servers under attack

Defending Exchange servers under attack

Exchange servers are high-value targets. These attacks also tend to be advanced threats with highly evasive, fileless techniques. Keeping these servers safe from these advanced attacks is of utmost importance.
Read more Defending Exchange servers under attack
Featured image for Microsoft continues to extend security for all with mobile protection for Android

Microsoft continues to extend security for all with mobile protection for Android

Announcing the public preview of Microsoft Defender ATP for Android! In the rapidly evolving world of mobile threats, Microsoft is taking a holistic approach to tackling these challenges and to securing enterprises and their data with our new mobile threat defense capabilities.
Read more Microsoft continues to extend security for all with mobile protection for Android
Featured image for Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint

Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint

In the first blog in the Inside Microsoft Threat Protection series, we will show how MTP provides unparalleled end-to-end visibility into the activities of nation-state level attacks like HOLMIUM.
Read more Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint
Featured image for UEFI scanner brings Microsoft Defender ATP protection to a new level

UEFI scanner brings Microsoft Defender ATP protection to a new level

The UEFI scanner is a new component of the built-in antivirus solution on Windows 10 and gives Microsoft Defender ATP the ability to scan inside of the firmware filesystem and perform security assessment.
Read more UEFI scanner brings Microsoft Defender ATP protection to a new level