Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-02-02 ⋅ Click All the Things! Blog ⋅ Jamie
XLSB: Analyzing a Microsoft Excel Binary Spreadsheet
2021-02-01 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
What tracking an attacker email infrastructure tells us about persistent cybercriminal operations
Dridex Emotet Makop Ransomware SmokeLoader TrickBot
2021-01-28 ⋅ YouTube (Microsoft Security Community) ⋅ Microsoft
Microsoft 365 Defender webinar: Protect, Detect, and Respond to Solorigate using M365 Defender
SUNBURST
2021-01-28 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
ZINC attacks against security researchers
ComeBacker Klackring
2021-01-21 ⋅ Medium CSIS Techblog ⋅ Søren Fritzbøger
Silencing Microsoft Defender for Endpoint using firewall rules
2021-01-20 ⋅ Microsoft ⋅ Microsoft 365 Defender Research Team, Microsoft Cyber Defense Operations Center (CDOC), Microsoft Threat Intelligence Center (MSTIC)
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
Cobalt Strike SUNBURST TEARDROP
2021-01-19 ⋅ Malwarebytes ⋅ Marcin Kleczynski
Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments
2021-01-19 ⋅ Mandiant ⋅ Douglas Bienstock, Matthew McWhirt, Mike Burns, Nick Bennett
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 (WHITE PAPER)
2021-01-19 ⋅ FireEye ⋅ Douglas Bienstock, Matthew McWhirt, Mike Burns, Nick Bennett
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
2021-01-14 ⋅ Microsoft ⋅ Microsoft 365 Defender Team
Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender
SUNBURST
2021-01-08 ⋅ US-CERT ⋅ US-CERT
Alert (AA21-008A): Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
SUNBURST SUPERNOVA
2020-12-31 ⋅ Microsoft ⋅ MSRC Team
Microsoft Internal Solorigate Investigation Update
SUNBURST
2020-12-28 ⋅ Microsoft ⋅ Microsoft 365 Defender Team
Using Microsoft 365 Defender to protect against Solorigate
SUNBURST TEARDROP
2020-12-26 ⋅ The Washington Post ⋅ Ellen Nakashima
Russian hackers compromised Microsoft cloud customers through third party, putting emails and other data at risk
2020-12-22 ⋅ Microsoft ⋅ Alex Weinert
Azure AD workbook to help you assess Solorigate risk
SUNBURST
2020-12-21 ⋅ Microsoft ⋅ MSRC Team
Solorigate Resource Center
SUNBURST TEARDROP
2020-12-21 ⋅ Microsoft ⋅ Tom Burt
Cyber Mercenaries Don’t Deserve Immunity
2020-12-21 ⋅ US Court of Appeals for the Ninth Court ⋅ Cisco, Github, Google, Internet Association, LinkedIn, Microsoft, VMWare, WhatsApp
Case: 20-16408: WhatsApp et al. vs NSO Group
2020-12-21 ⋅ Microsoft ⋅ Detection and Response Team (DART)
Advice for incident responders on recovery from systemic identity compromises
2020-12-21 ⋅ Microsoft ⋅ Alex Weinert
Understanding "Solorigate"'s Identity IOCs - for Identity Vendors and their customers.
SUNBURST