Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Cloud AppEvents
Hunting malicious OneOnOne chats via MS Teams
In recent years, there has been a noticeable increase in malicious activity involving hackers leveraging Microsoft Teams as an attack vector. Threat actors from external domains initiate one-on-one chats with users within our organization, impersonating support teams or other trusted entities. Their goal is to establish credibility and deceive employees into engaging with them.
File hosting services misused for identity phishing
Microsoft has observed campaigns misusing legitimate file hosting services increasingly use defense evasion tactics involving files with restricted access and view-only restrictions. While these campaigns are generic and opportunistic in nature, they involve sophisticated techniques to perform social engineering, evade detection, and expand threat actor reach to other accounts and tenants.
Storm-0501: Ransomware attacks expanding to hybrid cloud environments
Microsoft has observed the threat actor tracked as Storm-0501 launching a multi-staged attack where they compromised hybrid cloud environments and performed lateral movement from on-premises to cloud environment, leading to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. The said attack targeted multiple sectors in the United States, including government, manufacturing, transportation, and law enforcement.
Hunting in Azure subscriptions
In the realm of cybersecurity, the ability to efficiently comprehend and utilize logs within Azure subscriptions for threat hunting is paramount. These investigations typically involve meticulous log analysis aimed at identifying the initial breach and the subsequent actions executed by the Threat Actor.
Hunting in Azure Subscription
In the realm of cybersecurity, the ability to efficiently comprehend and utilize logs within Azure subscriptions for threat hunting is paramount. These investigations typically involve meticulous log analysis aimed at identifying the initial breach and the subsequent actions executed by the Threat Actor.
Midnight Blizzard: Guidance for responders on nation-state attack
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. The Microsoft Threat Intelligence investigation identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as NOBELIUM.
Threat actors misuse OAuth applications to automate financially driven attacks Original
Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity.
AiTM & BEC threat hunting with KQL
The evolving phishing threat is relentless and continues to grow each year. Attackers have been changing their tactics, techniques, and procedures, moving from traditional phishing to more advanced techniques. Especially, AiTM is a great example of how attack techniques have evolved over the past few years and have spread globally.
Advanced hunting for Microsoft Purview Data Loss Prevention (DLP) incidents
1. Introduction Microsoft 365 Defender is the Microsoft-recommended experience for investigation and remediation of Microsoft Purview Data Loss Prevention (DLP) incidents. Please refer to the step-by-step guided walkthrough published earlier to learn how to investigate Microsoft Purview Data Loss Prevention alert in Microsoft 365 Defender.
Learn how to investigate Microsoft Purview Data Loss Prevention alerts in Microsoft 365 Defender
This is step-by-step guided walkthrough of the Microsoft 365 Defender Analyst experience for Microsoft Purview Data Loss Prevention (DLP) incident management. This is the Microsoft-recommended experience for investigation and remediation of Data Loss Prevention incidents.
Good UAL Hunting
Good UAL Hunting In our last blog on this series, Forensic artifacts in Office 365 and where to find them, we spoke about where data relating to Office 365 can be found and which endpoints can be used to effectively conduct a cybersecurity investigation. In this blog post, we will be taking a deeper dive into one of those data sources, the Office 365 Unified Audit Log (UAL).
Malicious OAuth applications abuse cloud email services to spread spam
Microsoft researchers recently investigated an attack where malicious OAuth applications were deployed on compromised cloud tenants and then used to control Exchange Online settings and spread spam. The investigation revealed that the threat actor launched credential stuffing attacks against high-risk accounts that didn’t have multi-factor authentication (MFA) enabled and leveraged the unsecured administrator accounts to gain initial access.
Re: Hunt for compromised Azure subscriptions using Microsoft Defender for Cloud Apps
In our present threat landscape, attackers are constantly trying to compromise organizations, each with their own set of motives. They may want to compromise accounts credentials to later sell, utilize compromised users to spread phishing campaigns, or even utilize the computing resources of the organization to deploy and run their own tooling. In this blog, we will describe how attackers can compromise Azure subscriptions and use them for malicious activities.
Microsoft Cloud App Security: The Hunt for Insider Risk
Welcome back to our second post in the “Microsoft Cloud App Security: The hunt” series! If you haven’t read the first post by Sebastien Molendijk, head over to Microsoft Cloud App Security: The hunt in a multi-stage incident - Microsoft Tech Community to see how you can leverage advanced hunting to investigate a multi-stage incident.
Microsoft Cloud App Security: The Hunt for Insider Risk
May 11 2021 10:37 PM Welcome back to our second post in the “Microsoft Cloud App Security: The hunt” series! If you haven’t read the first post by Sebastien Molendijk, head over to Microsoft Cloud App Security: The hunt in a multi-stage incident - Microsoft Tech Community to see how you can leverage advanced hunting to investigate a multi-stage incident.
Hunt across cloud app activities with Microsoft 365 Defender advanced hunting
We’re thrilled to share that the new CloudAppEvents table is now available as a public preview in advanced hunting for Microsoft 365 Defender.
How To Use Open Architecture For AI Solutions
Learn how to effectively utilize Open Architecture for AI Solutions to enhance your AI projects and streamline processes. The framework for autonomous intelligence Monitoring Azure Open AI Deployments To effectively monitor Azure Open AI deployments, leveraging Microsoft Sentinel is essential. This integration allows for enhanced visibility and alerting capabilities, particularly when combined with Defender for Cloud Apps (MCAS).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Cloud
Contact Cloud, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack