Microsoft

Microsoft technical breakdown of CrowdStrike incident

We examine the recent CrowdStrike outage and provide a technical overview of the root cause.

Microsoft finds privilege escalation vulnerability in Huawei driver

Our discovery of two privilege escalation vulnerabilities in a driver highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.

DEV-0537 targeting organizations for data exfiltration and destruction

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.

Attack Matrix for Kubernetes

While Kubernetes has many advantages, it also brings new security challenges.

Analyzing the compromised DLL file that started the Solorigate attack

We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance, and detections and protections we have built as a result.

Simple Encrypted Arithmetic Library goes open source

Today we are extremely excited to announce that our Microsoft Simple Encrypted Arithmetic Library (Microsoft SEAL), an easy-to-use homomorphic encryption library developed by researchers in the Cryptography Research group at Microsoft, is open source on GitHub under an MIT License for free use. The library has already…

Microsoft has detected nation-state activity associated with NOBELIUM

The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations.

Hardening attack surfaces with formally proven binary format parsers

With an eye toward performance, interoperability, or legacy concerns, low-level system software often must parse binary encoded data formats. Few tools are available for this task, especially since the formats involve a mixture of arithmetic and data dependence, beyond what can be handled by typical parser generators…

Microsoft Announces Direct Cash Payments For Vulnerabilities

Critical: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution

Analysis of Storm-0558 techniques for unauthorized email access

Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.