Windows 10: Announcing Microsoft Threat Experts

Brink · Feb 28, 2019

We’re excited to introduce Microsoft Threat Experts, an additional layer of expertise and optics that Microsoft customers can utilize to augment security operations capabilities as part of Microsoft 365. This new managed threat hunting service in Windows Defender Advanced Threat Protection provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately.

Microsoft Threat Experts enables SOCs to jump-start threat investigations by providing context-rich intelligence. This release of the service includes 2 capabilities:

Targeted attack notifications: Alerts that are tailored to organizations provide as much information as can be quickly delivered to bring attention to critical threats in their network, including the timeline, scope of breach, and the methods of intrusion.

Experts on demand: When a threat exceeds the SOC’s capability to investigate, or when more actionable information is needed, security experts provide technical consultation on relevant detections and adversaries. In cases where a full incident response becomes necessary, seamless transition to Microsoft incident response (IR) services is available.

[youtube]hMYOb81kDYE[/youtube]
Microsoft Threat Experts

With Microsoft Threat Experts, SOCs can further improve defenses by tapping into our world-class security analysts. These experts deeply understand the security landscape and attacker techniques, have intimate knowledge of operating systems, and know how to get the most out of Windows Defender ATP’s features and capabilities. Our experience in battling attackers across more than a billion devices worldwide, together with the artificial intelligence (AI) necessary to harness such unprecedented optics and scale, makes our expert team unique and unmatched in the industry.

The next sections describe the two components of this new service in more detail.

Targeted attack notifications

Microsoft Threat Experts provides proactive hunting for the most important threats, such as human adversary intrusions, hands-on-keyboard attacks, and advanced attacks like cyberespionage. The managed threat hunting service includes:

Threat monitoring and analysis, reducing attacker dwell time and risk to business

Hunter-trained AI to discover and prioritize both known and unknown attacks

Identifying the most important risks, helping SOCs maximize time and energy

Scope of compromise and as much context as can be quickly delivered to enable fast SOC response

Custom Threat Experts alert in Windows Defender Security Center

Experts on demand

Customers can partner with Microsoft security experts, who can be engaged directly from within Windows Defender Security Center, for timely and accurate response. Experts provide insights needed to better understand complex threats, from the latest zero-day exploit to the root cause of a suspicious network connection. Through Microsoft Threat Experts, customers can:

Get additional clarification on alerts including root cause or scope of the incident

Gain clarity into suspicious machine behavior and recommended next steps if faced with an advanced attacker

Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques

Seamlessly transition to Microsoft Incident Response (IR) services when necessary

Ask a Threat Expert button in Windows Defender Security Center

Partnership for improved security

In today’s climate of cybersecurity challenges, organizations must fend off relentless attacks even as they go through their journey of building and maturing their security capabilities. Through Microsoft Threat Experts, customers can partner with Microsoft throughout this journey to augment security operations capabilities to prevent, detect, and respond to threats. Customers and Microsoft can build upon each other’s expertise, intelligence, and insight through this partnership, forming stronger defense against adversaries.

To illustrate the depth of intelligence and the value of the service to customers’ security defenses and overall security posture, we published two case studies for Microsoft Threat Experts on (1) human adversary-based activities related to a zero-day vulnerability and (2) complex “living off the land” threats.

Windows Defender ATP customers can now apply for preview through the Windows Defender Security Center. We will contact customers via email to confirm their participation.

Not yet reaping the benefits of Windows Defender ATP’s industry-leading optics and detection capabilities? Sign up for free trial today.
Click to expand...

Source: Announcing Microsoft Threat Experts - Microsoft Security

See also: Microsoft Threat Experts: Case studies for managed threat hunting service - Microsoft Tech Community - 358244

Tweet

— Twitter API (@User) View on Twiiter

:)

Joe Men · Feb 28, 2019

called announce

I have provided the steps on how you can enable the Use Speech to announce caller ID in my initial response.

For your convenience, here the detailed steps:

Launch the Settings app.

Tap Ease of Access.

Tap More options.

Tap the On/Off slider under the Use Speech to announce caller ID to set it on or off.

Feel free to post back if you need further assistance.

Brink · Feb 28, 2019

Microsoft Advanced Threat Analytics - NotPetya malware

On June 27, 2017 reports on a new variant of Petya (which was later referred to as NotPetya) malware infection began spreading across the globe. It seems the malware’s initial infection delivered via the “M.E.doc” update service, a Ukrainian finance application. Based on our investigation so far, the propagation steps executed by the malware can be considered sophisticated and well tested.The malware distributes itself as a DLL file, spreading over internal networks using different lateral movement techniques.

This blog post focuses on the network behavior analysis of NotPetya and the techniques it uses to propagate in the network. This is ongoing research, and we’ll update with additional findings as those become available.

Malware Propagation Flows

Delivery & Initial execution

The malware is delivered via the “M.E.doc” service to infect the first endpoint.

The malware executes and extracts the relevant components to disk. These include:

PsExec – Network remote execution tool.

A credential dumping tool.

More information on these steps can be found at the Windows Security blog.

Reconnaissance

The internal network is probed using multiple discovery methods to identify new workstations and domain controllers. These include:

LANMAN NetServerEnum2 API used to get information about workstations and domain controllers.

Probing using ports 139 and 445 to other endpoints.

If a domain controller is accessible, the malware queries its DHCP Service to enumerate DHCP subnet.

In case DHCP subnets are discovered, the malware will continue its discovery against those subnets as well.

Reconnaissance example – NetServerEnum2

In the screenshot above, we can see the NetServerEnum2 API used by the infected machine.

The response includes the domain controller and a list of all known workstations response.

Lateral Movement

To spread itself on the network, the malware tries to access the administrative share ($admin).

If the SeDebugPrivilege privilege obtained (Step2), a credentials dumping tool is used to recover additional user credentials from the local memory.

Our lab tests have shown that in addition to the current account session, only one additional user is used by the malware to probe the remote hosts. The malware seems to ignore memory dumped users who were tagged under a new credentials session. Moreover, it seems like only one user (the last one who is in memory) is used to probe the destination host

Each target endpoint is accessed using multiple authentication protocols, such as NTLM and Kerberos over GSSAPI (SPNEGO). The credentials used for access are:

Current user context, under which the malware is running.

Successfully dumped credentials (if available).

In the screenshot below, we can see multiple CIFS ticket requests performed by the malware on behalf of the dumped user. Such broad abnormal access attempts performed by the malware will be detected by Microsoft Advanced Threat Analytics’ (ATA) abnormal behavior detection. Based on previously learned user behavior analytics, the detection mechanism will recognize and alert on the abnormal resource access performed by the malware using the compromised credentials.

Multiple TGS-REQ

In the screenshot above, we can see multiple CIFS ticket requests.

Example of abnormal user access – ATA

Remote Execution

If access to the administrative share was obtained, the malware copies itself to the target host and executes PSEXEC and WMIC.

Malware Copy

PSEXEC Service creation

In the screenshot above, the infected host starts executing the PSEXEC tool.

Exploitation (optional)

If all propagation steps failed, the malware tries to execute one of the SMB exploits (MS17-010).

Available SMB Exploits:

EternalBlue – CVE-2017-0144

EternalRomance – CVE-2017-0145

The above steps are performed simultaneously, using multiple threads and runs against each target host. For further information regarding the SMB exploit mitigation, malware encryption steps and initial infection stage, please refer to the Petya worm capabilities blog post.

The spreading capabilities used by the NotPetya malware introduce a new level of sophistication when executing lateral movement.

Detection and mitigation

Microsoft Advanced Threat Analytics allows customers to detect and to investigate a variety of advanced techniques including the lateral movement technique used by NotPetya.

This type of lateral movement can be detected by ATA as abnormal resource access – given the large scanning performed by the user to attempt access additional endpoints on the subnet.

There are several ways customers can detect and prevent NotPetya from impacting their environment.

First, we strongly recommend customers that have not yet installed security update MS17-010 to do so as soon as possible. If applying the patch is not possible, disable SMB V1 on the corporate networks.

Second, we recommend that you verify good credential hygiene. To learn more, read the following article about protecting high value assets with secure admin workstations.

Additional Resources

KB

MS17-010 Security Update

Blog

New ransomware, old techniques: Petya adds worm capabilities

Windows 10 platform resilience against the Petya ransomware attack

Click to expand...

Source: Advanced Threat Analytics security research network technical analysis: NotPetya Microsoft Secure

hurricane51 · Feb 28, 2019

Edge Search Does Not Permit Change of Region

I got these suggestions from the Microsoft Community forum.No. 1 worked for me:

Thank you for posting the query on Microsoft Community. I am glad to assist you on this.
We have reproduce the issue here and we are able to access non-regional search for google using Microsoft Edge.
I would suggest you to try the below steps and check if it helps.
Step 1:
Clear browsing data option of Microsoft Edge and check if you face the issue. To do so perform the steps below.

Click on the More actions icon next to the feedback icon present on top right corner of the Project Spartan homepage.

Select Settings and click on Choose what to clear.

Check the boxes Browsing history, Cookies and saved website data and Cached data and files and click on Clear.

Step 2:
I suggest you to create a new user account and check if the issue occurs.

Go to Settings.

Choose Accounts and then select Family and other users.

Select add someone else on this PC.

Enter a user name and hit next.

Click on Finish.

Sign out from the current Account and Log into the new account.

Step 3:
It could also happen because of network issue. I suggest you to try with different network connection and check if it helps.

Windows 10: Announcing Microsoft Threat Experts

Announcing Microsoft Threat Experts

Announcing Microsoft Threat Experts

Announcing Microsoft Threat Experts

Announcing Microsoft Threat Experts - Similar Threads - Announcing Microsoft Threat

Talk to an expert

Talk to an expert

I need to speak to a Microsoft expert

I need to speak to a Microsoft expert

Not an expert!

I want to speak to a Microsoft expert

Announcing Microsoft Search

Announcing Threat Trackers for Office 365 Threat Intelligence

Announcing Windows Defender Advanced Threat Protection for Enterprise