Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by project Timestamp
tracking CVE-2026-73570
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthe 2026-9-30 14:0:0 Author: www.microsoft.com(查看原文) 阅读量:1 收藏 Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | #ransomware | #cybercrime
Tactic Observed activity Microsoft Defender coverage Execution Storm-2570 delivers tools such as PsExec, Impacket, NetExec, and RDP batch scripts, to carry out post-compromise activity Microsoft Defender Antivirus – Behavior:Win32/PsexecRemote Microsoft Defender for Endpoint – Hands-on-keyboard attack involving multiple devices – Remote access software – Suspicious PowerShell command line – Suspicious PowerShell download or encoded command execution – Ransomware-linked threat actor detected...
Microsoft Defender XDR Queries Can Miss Public Connections Logged as FourToSixMapping
Microsoft Defender XDR detection rules can miss public network connections when they filter the DeviceNetworkEvents table only for RemoteIPType == "Public". Some IPv4 connections made through IPv6-capable sockets appear under the separate FourToSixMapping classification. The connection events remain available in Defender XDR.
How a single page can RCE the host running your AI agent
Ongoing research into AI agent framework security identified an exploit chain in AutoGen Studio (AutoGen’s open-source prototyping user interface) that allows untrusted web content rendered by a browsing agent to reach a local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes on the host. The technique, which we call AutoJack, jacks the agent into becoming the attacker’s last-mile delivery vehicle by crossing the localhost trust boundary that many developer tools rely on.
Inside the Mastra npm supply chain compromise
From package to postinstall payload: Inside the Mastra npm supply chain compromise Microsoft Threat Intelligence observed a large-scale npm supply chain attack affecting 140+ pac 2026-6-18 03:43:4 Author: www.microsoft.com(查看原文) 阅读量:0 收藏 Microsoft Threat Intelligence observed a large-scale npm supply chain attack affecting 140+ packages across the mastra and @mastra scopes on the npm registry.
Inside the Red Hat npm Miasma credential-stealing campaign
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 mal 2026-6-3 04:45:6 Author: www.microsoft.com(查看原文) 阅读量:7 收藏 Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 maliciously modified packages across more than 90 versions under the @redhat-cloud-services npm scope.
Microsoft Defender Mistakenly Flags DigiCert Root Certificates as Malware
Microsoft Defender triggered widespread false positive alerts after a faulty security update caused it to flag two legitimate DigiCert root certificates as malicious, potentially disrupting SSL/TLS validation and code-signing operations across enterprise environments worldwide.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been compromising insecure home and small-office internet equipment like routers, then modifying their settings in ways that turn them into part of the actor’s malicious infrastructure. The threat actor then hides behind this legitimate but compromised infrastructure to spy on additional targets or conduct follow-on attacks.
Vulnerabilidad en token de identidad de Azure permite compromiso total en Windows Admin Center
Una vulnerabilidad de alta gravedad en la implementación de Azure Single Sign-On del Windows Admin Center ha expuesto máquinas virtuales de Azure y sistemas conectados a Arc a accesos no autorizados en inquilinos completos. Los laboratorios de investigación de Cymulate descubrieron el fallo, ahora registrado como CVE-2026-20965, que demuestra cómo una validación incorrecta de tokens puede derribar los límites de seguridad entre máquinas individuales y entornos completos de Azure.
Azure Identity Token Vulnerability Enables Tenant-Wide Compromise in Windows Admin Center Original
A high-severity vulnerability in Windows Admin Center’s Azure Single Sign-On implementation has exposed Azure virtual machines and Arc-connected systems to unauthorized access across entire tenants. Cymulate Research Labs discovered the flaw, now tracked as CVE-2026-20965, which demonstrates how improper token validation can collapse security boundaries between individual machines and complete Azure environments.
Protecting the Evidence in Real-Time with KQL Queries
A few weeks ago, I published a post titled Detecting Ransomware Final Stage Activities with KQL Queries where I shared different phases and detections during the last phase of a ransomware attack. Every time I read it, I realize just how broad and complex this topic truly is.
Microsoft Releases Mitigations and Threat Hunting Queries for SharePoint Zero-Day
Thousands of organizations worldwide face active cyberattacks targeting Microsoft SharePoint servers through two critical vulnerabilities, prompting urgent government warnings and emergency patches. Microsoft confirmed over the weekend that threat actors are actively exploiting two zero-day vulnerabilities in on-premises SharePoint servers, designated CVE-2025-53770 and CVE-2025-53771.
Critical Vulnerabilities in Microsoft SharePoint
History: 21/07/2025 --- v1.0 -- Initial publication 21/07/2025 --- v1.1 -- Updated information Summary On July 19, 2025, Microsoft released an out-of-bound advisory addressing two vulnerabilities, one of which being rated as critical and allowing unauthenticated remote attacker to execute arbitrary code on vulnerable systems [1]. This critical flaw is actively being exploited in the wild since at least 18th of July 2025 [4].
Customer guidance for SharePoint vulnerability CVE-2025-53770
Revision Change Date 1.0 Information published 07/19/25 2.0 Clarified affected SharePoint product in summary 07/20/25 Added fix availability guidance Provided additional protections guidance regarding: Upgrade SharePoint products to supported versions (if required) Install July 2025 Security Updates Rotate machine keys Updated Microsoft Defender detections and protections section: Documented additional MDE alerts Mapping exposure via Microsoft Defender Vulnerability Management Documented...
Identifying Ransomware Final Stage activities with KQL Queries
When ransomware strikes, it doesn’t just encrypt files — it often wraps up with a series of stealthy moves meant to lock you out, cover tracks, and make recovery a nightmare. That’s why it’s so important to spot these final-stage activities before the damage is permanent. The techniques below are commonly seen during the final stage of ransomware attacks, and I recommend setting them up as detection rules in your Defender XDR or Microsoft Sentinel environment.
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
Executive summary: Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Void Blizzard is a new threat actor Microsoft Threat Intelligence has observed conducting espionage operations primarily targeting organizations that are important to Russian government objectives.
Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
Over the past year, Microsoft observed the persistent growth and operational sophistication of Lumma Stealer, an infostealer malware used by multiple financially motivated threat actors to target various industries. Our investigation into Lumma Stealer’s distribution infrastructure reveals a dynamic and resilient ecosystem that spans phishing, malvertising, abuse of trusted platforms, and traffic distribution systems.
Marbled Dust leverages zero-day in Output Messenger for regional espionage
Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output Messenger, a multiplatform chat software. These exploits have resulted in collection of related user data from targets in Iraq.
Understanding the threat landscape for Kubernetes and containerized assets
The dynamic nature of containers can make it challenging for security teams to detect runtime anomalies or pinpoint the source of a security incident, presenting an opportunity for attackers to stay undetected. Microsoft Threat Intelligence has observed threat actors taking advantage of unsecured workload identities to gain access to resources, including containerized environments.
DNS Response analysis with KQL: queries, answers, TTL, RTT & more
A key aspect of threat hunting is monitoring where identities and devices connect by analyzing RemoteIP, Domains, and URLs. Matching these indicators with external threat intelligence feeds helps assess their reputation and trigger alerts or actions. While having strong detection and monitoring enhances defense, an often-overlooked factor is analyzing the responses from remote destinations — what they return could reveal additional threats and here it is where can talk about DNS Response.
Mastering AI Automation: The Ultimate Guide to Power Platform, Azure and Graph API Integration
The Future is Here: AI-Driven Enterprise Automation! Artificial Intelligence is transforming Microsoft 365, Azure & Power Platform. But how do we automate workflows at scale while keeping them secure, efficient & future-proof? In this guide, we’ll unlock deep AI-powered automation strategies and implement real-world enterprise integrations using Power Automate, Graph API, KQL, and Microsoft Sentinel. Why AI-Driven Automation?
StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.
Malvertising campaign leads to info stealers hosted on GitHub
In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms.
Storm-2372 conducts device code phishing campaign
Executive summary Today we’re sharing that Microsoft discovered cyberattacks being launched by a group we call Storm-2372, who we assess with medium confidence aligns with Russia’s interests and tradecraft. The attacks appear to have been ongoing since August 2024 and have targeted governments, NGOs, and a wide range of industries in multiple regions.
New Star Blizzard spear-phishing campaign targets WhatsApp accounts
In mid-November 2024, Microsoft Threat Intelligence observed the Russian threat actor we track as Star Blizzard sending their typical targets spear-phishing messages, this time offering the supposed opportunity to join a WhatsApp group. This is the first time we have identified a shift in Star Blizzard’s longstanding tactics, techniques, and procedures (TTPs) to leverage a new access vector.
Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage
Based on both Microsoft Threat Intelligence’s findings and those reported by governments and other security vendors, we assess that the Russian nation-state actor tracked as Secret Blizzard has used the tools and infrastructure of at least six other threat actors during the past seven years. They also have actively targeted infrastructure where other threat actors have staged exfiltrated data from victims with the intention of collecting this data for their own espionage program.
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Since October 22, 2024, Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. This activity is ongoing, and Microsoft will continue to investigate and provide updates as available.
North Korean threat actor Citrine Sleet exploiting Chromium zero-day
On August 19, 2024, Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium, now identified as CVE-2024-7971, to gain remote code execution (RCE). We assess with high confidence that the observed exploitation of CVE-2024-7971 can be attributed to a North Korean threat actor targeting the cryptocurrency sector for financial gain. Our ongoing analysis and observed infrastructure lead us to attribute this activity with medium confidence to Citrine Sleet.
Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations
Between April and July 2024, Microsoft observed Iranian state-sponsored threat actor Peach Sandstorm deploying a new custom multi-stage backdoor, which we named Tickler. Tickler has been used in attacks against targets in the satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the United Arab Emirates.
Using Defender XDR Portal to hunt for Kubernetes security issues
As we saw in previous article, the binary drift alert gives you information about where the activity happened like the object namespace, image, cluster, etc. This might or might not be enough information for you to act. Say, if you want to identify “how” this drift came to be for example, did a user logged on to container and downloaded the said binary.
Hunting for MFA manipulations in Entra ID tenants using KQL
Cloud security is a top priority for many organizations, especially given that threat actors are constantly looking for ways to compromise cloud accounts and access sensitive data. One of the common, and highly effective, methods that attackers use is changing the multi-factor authentication (MFA) properties for users in compromised tenants. This can allow the attacker to satisfy MFA requirements, disable MFA for other users, or enroll new devices for MFA.
Hunting in Azure Subscription
In the realm of cybersecurity, the ability to efficiently comprehend and utilize logs within Azure subscriptions for threat hunting is paramount. These investigations typically involve meticulous log analysis aimed at identifying the initial breach and the subsequent actions executed by the Threat Actor.
Hunting in Azure subscriptions
In the realm of cybersecurity, the ability to efficiently comprehend and utilize logs within Azure subscriptions for threat hunting is paramount. These investigations typically involve meticulous log analysis aimed at identifying the initial breach and the subsequent actions executed by the Threat Actor.
Securing gateways and control points
When AI infrastructure becomes the target: Securing gateways and control points AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchest 2026-8-26 16:43:53 Author: www.microsoft.com(查看原文) 阅读量:4 收藏 AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchestration services, and containerized runtimes now sit between users, applications, data, and models.
Follow the Breadcrumbs with Microsoft Incident Response and MDI: Working Together to Fight Identity
In cybersecurity incidents, one of the first to gain credentials and elevate their privileges. For this reason, they will almost always target user identities and the underlying identity infrastructure. This blog post discusses how Microsoft Incident Response and Microsoft Defender for Identity (MDI) work together to fight identity-based attacks. We demonstrate how MDI can be used to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions.
Azure Serial Console Attack and Defense - Part 2
This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines.
Threat actors misuse OAuth applications to automate financially driven attacks Original
Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity.
Diamond Sleet supply chain compromise distributes a modified CyberLink installer
Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload.
AiTM & BEC threat hunting with KQL
The evolving phishing threat is relentless and continues to grow each year. Attackers have been changing their tactics, techniques, and procedures, moving from traditional phishing to more advanced techniques. Especially, AiTM is a great example of how attack techniques have evolved over the past few years and have spread globally.
The five-day job: A BlackByte ransomware intrusion case study
As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) of an intrusion, we found that the threat actor progressed through the full attack chain, from initial access to impact, in less than five days, causing significant business disruption for the victim organization.
Extracting relational schema from streaming data containing complex JSON documents
Author: @devangshah is a Principal Program Manager for Data Explorer in the Synapse Customer Success Engineering (CSE) team. In the world of IoT devices, industrial historians, infrastructure and application logs, and metrics, machine-generated or software-generated telemetry, there are often scenarios where the upstream data producer produces data in non-standard schemas, formats, and structures that often make it difficult to analyze the data contained in these at scale.
Importing Data from RabbitMQ into Azure Data Explorer via Event Hubs
Imagine you have sensor data that’s being sent to RabbitMQ from various IoT devices. These devices capture temperature and humidity readings. You want to use the power of Azure Data Explorer to analyze this data and apply intelligent insights to it. You have the challenge of getting the data out of RabbitMQ and into Azure. Using Azure Event Hubs, you can bridge RabbitMQ with Azure Data Explorer.
Investigate behaviors with advanced hunting (Preview) - Microsoft Defender for Cloud Apps
Read in English Read in English Edit Twitter LinkedIn Facebook Email Article 03/29/2023 4 minutes to read In this article Note Microsoft Defender for Cloud Apps (previously known as Microsoft Cloud App Security) is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services.
Learn how to investigate Microsoft Purview Data Loss Prevention alerts in Microsoft 365 Defender
This is step-by-step guided walkthrough of the Microsoft 365 Defender Analyst experience for Microsoft Purview Data Loss Prevention (DLP) incident management. This is the Microsoft-recommended experience for investigation and remediation of Data Loss Prevention incidents.
Malicious OAuth applications abuse cloud email services to spread spam
Microsoft researchers recently investigated an attack where malicious OAuth applications were deployed on compromised cloud tenants and then used to control Exchange Online settings and spread spam. The investigation revealed that the threat actor launched credential stuffing attacks against high-risk accounts that didn’t have multi-factor authentication (MFA) enabled and leveraged the unsecured administrator accounts to gain initial access.
Re: Hunt for compromised Azure subscriptions using Microsoft Defender for Cloud Apps
In our present threat landscape, attackers are constantly trying to compromise organizations, each with their own set of motives. They may want to compromise accounts credentials to later sell, utilize compromised users to spread phishing campaigns, or even utilize the computing resources of the organization to deploy and run their own tooling. In this blog, we will describe how attackers can compromise Azure subscriptions and use them for malicious activities.
Migrate advanced hunting queries from Microsoft Defender for Endpoint
Read in English Read in English Feedback Edit Twitter LinkedIn Facebook Email Article 04/05/2022 6 minutes to read In this article Note Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender. Applies to: Microsoft 365 Defender Move your advanced hunting workflows from Microsoft Defender for Endpoint to proactively hunt for threats using a broader set of data.
KQL Series – KQL usage with Advanced Hunting (this is huge) – SQLServerCentral
This blog post is about another use of KQL that will definitely help your organisation and make you very popular. First of all check out this video here which can help you learn stuff about KQL: https://www.microsoft.com/en-us/videoplayer/embed/RWRwfJ?postJsllMsg=true I have been talking about KQL and using it with Log Analytics and also Application Insights.
Vulnerabilidades Directorio Activo permiten hackear controlador de dominio en Windows
Microsoft ha publicado un aviso fuera de ciclo de dos vulnerabilidades publicadas en noviembre y que, combinadas, podrían permitir a un atacante la escalada de privilegios de dominio. Las pruebas de concepto se han dado a conocer públicamente en diciembre.La cadena de vulnerabilidades (NoPaC, sAMAccountName) que está pasando algo desapercibida pero mediante la cual cualquier persona dentro de la red podría usar para hackear un DC.
Timelines
Photo by Peter Stumpf on Unsplash This is an excerpt from my book Data Engineering on Azure. The code examples in this article use Azure Data Explorer. If you want to run them, create an Azure Data Explorer cluster and database. Once this is set up, you can use the Data Explorer web UI to connect to your cluster and database and run the code samples. Azure Data Explorer uses KQL, the Kusto Query Language. If you are not familiar with it, you can check out the quick reference.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with project
Contact project, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack