Microsoft Defender Experts Cybersecurity Incident Response, Author at Microsoft Security Blog

Looking into a conference room or board room meeting including people sitting around table in a room with international time clocks

Research July 6, 2023 17 min read

The five-day job: A BlackByte ransomware intrusion case study

In a recent investigation by Microsoft Incident Response of a BlackByte 2.

Graphic illustrating Microsoft Incident Response

Best practices June 29, 2023 3 min read

Patch me if you can: Cyberattack Series

The Microsoft Incident Response team takes swift action to help contain a ransomware attack and regain positive administrative control of the customer environment.

An icon of an ID badge and shield are shown, and the shield features a tick mark. They represent an individuals credentials to keep safe to prevent cybersecurity attacks

Best practices April 26, 2023 3 min read

Healthy security habits to fight credential breaches: Cyberattack Series

This is the second in an ongoing series exploring some of the most notable cases of the Microsoft Incident Response Team.

IT professionals at a digital consulting firm. The firm provides custom solutions across a multitude of disciplines including IT, front and back end software development, customer support and data services

Research April 11, 2023 8 min read

Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign

This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.

News March 27, 2023 4 min read

Microsoft Incident Response Retainer is generally available

Microsoft Security is expanding its incident response presence and we’re excited to announce the Microsoft Incident Response Retainer is now generally available.

Photo of enterprise office workers in focused work in an open work space

Research March 24, 2023 20 min read

Guidance for investigating attacks using CVE-2023-23397

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397.

Multicolor arrows pointing towards a center dot, with a yellow diamond filled with 1’s and 0’s and a bug crawling towards it to suggest malware

Best practices February 8, 2023 2 min read

Solving one of NOBELIUM’s most novel attacks: Cyberattack Series

This is the first in an ongoing series exploring some of the most notable cases of the Microsoft Detection and Response Team (DART), which investigates cyberattacks on behalf of our customers.

female developer wearing headphones; coding at her PC workspace in an enterprise office, using Visual Studio on a multi-monitor set up

Research December 12, 2022 10 min read

IIS modules: The evolution of web shells and how to detect them

This blog aims to provide further guidance on detecting malicious IIS modules and other capabilities that you can use during your own incident response investigations.

Male developer coding in front of two monitors at desk in office. Programming code shown on both monitors

Research November 16, 2022 9 min read

Token tactics: How to prevent, detect, and respond to cloud token theft

As organizations increase their coverage of multifactor authentication (MFA), threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA.

Two males and three females collaborating in a conference room featuring an HP Teams Meeting Rooms touch display. The meeting has nine remote participants shown on a wall mounted display joined via Teams Meetings. Two subjects are using Surface devices

Best practices November 2, 2022 9 min read

Microsoft Security tips for mitigating risk in mergers and acquisitions

Mergers and acquisitions can be challenging. Microsoft’s Security Experts share what to ask before, during, and after one to secure identity, access control, and communications.

Practitioner and CISO collaboration in a security war room

Research October 18, 2022 13 min read

Defenders beware: A case for post-ransomware investigations

The Microsoft Detection and Response Team (DART) details a recent ransomware incident in which the attacker used a collection of commodity tools and techniques, such as using living-off-the-land binaries, to launch their malicious code.

Practitioner and CISO collaboration in a security operations center

Best practices September 21, 2022 6 min read

The art and science behind Microsoft threat hunting: Part 2

In this follow-up post in our series about threat hunting, we talk about some general hunting strategies, frameworks, tools, and how Microsoft incident responders work with threat intelligence.

Microsoft Defender Experts Cybersecurity Incident Response posts