Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-03-02 ⋅ Github (microsoft) ⋅ Microsoft
Microsoft-365-Defender-Hunting-Queries for hunting Gootkit malware delivery and C2
GootKit
2021-03-02 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Security Intelligence
Tweet on Gootkit malware campaign
GootKit
2021-03-02 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC)
HAFNIUM targeting Exchange Servers with 0-day exploits
PowerCat
2021-03-01 ⋅ Microsoft ⋅ Microsoft
Detect and defend against the recent nation-state cyber attack
SUNBURST
2021-02-25 ⋅ Microsoft ⋅ Microsoft
CodeQL queries to hunt for Solorigate activity
SUNBURST
2021-02-25 ⋅ Microsoft ⋅ Microsoft Identity Security Team
Microsoft open sources CodeQL queries used to hunt for Solorigate activity
SUNBURST
2021-02-18 ⋅ Microsoft ⋅ MSRC Team
Microsoft Internal Solorigate Investigation – Final Update
2021-02-12 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
Agent Tesla
2021-02-11 ⋅ Microsoft ⋅ Detection and Response Team (DART), Microsoft 365 Defender Research Team
Web shell attacks continue to rise
2021-02-09 ⋅ Medium (@alex.birsan) ⋅ Alex Birsan
Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
2021-02-09 ⋅ Microsoft ⋅ Microsoft
3 Ways to Mitigate Risk When Using Private Package Feeds
2021-02-09 ⋅ Microsoft ⋅ MSRC Team
Windows Win32k Elevation of Privilege Vulnerability CVE-2021-1732 (exploited ITW)
2021-02-09 ⋅ Microsoft ⋅ MSRC Team
Multiple Security Updates Affecting TCP/IP:  CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086
2021-02-05 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Microsoft warns of increasing OAuth Office 365 phishing attacks
2021-02-02 ⋅ Click All the Things! Blog ⋅ Jamie
XLSB: Analyzing a Microsoft Excel Binary Spreadsheet
2021-02-01 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
What tracking an attacker email infrastructure tells us about persistent cybercriminal operations
Dridex Emotet Makop Ransomware SmokeLoader TrickBot
2021-01-28 ⋅ YouTube (Microsoft Security Community) ⋅ Microsoft
Microsoft 365 Defender webinar: Protect, Detect, and Respond to Solorigate using M365 Defender
SUNBURST
2021-01-28 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
ZINC attacks against security researchers
ComeBacker Klackring
2021-01-21 ⋅ Medium CSIS Techblog ⋅ Søren Fritzbøger
Silencing Microsoft Defender for Endpoint using firewall rules
2021-01-20 ⋅ Microsoft ⋅ Microsoft 365 Defender Research Team, Microsoft Cyber Defense Operations Center (CDOC), Microsoft Threat Intelligence Center (MSTIC)
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
Cobalt Strike SUNBURST TEARDROP