Windows 10: Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence...

/u/NOT-JEFFREY-NELSON · Apr 21, 2020

submitted by /u/NOT-JEFFREY-NELSON
[link] [comments]

:)

Brink · Apr 21, 2020

Microsoft Security Intelligence Report Volume 22 is now available

The latest volume of the Microsoft Security Intelligence Report is now available for free download at http://www.microsoft.com/sir" target="_blank" rel="nofollow">.

This new volume of the report includes threat data from the first quarter of 2017. The report also provides specific threat data for over 100 countries/regions. As mentioned in a recent blog, using the tremendous breadth and depth of signal and intelligence from our various cloud and on-premises solutions deployed globally, we investigate threats and vulnerabilities and regularly publish this report to educate enterprise organizations on the current state of threats and recommended best practices and solutions.

In this 22nd volume, we’ve made two significant changes:

We have organized the data sets into two categories, cloud and endpoint. Today, most enterprises now have hybrid environments and it’s important to provide more holistic visibility.

We are sharing data from a shorter time period, one quarter (January 2017 – March 2017), instead of the typical six months, as we shift our focus to delivering improved and more frequent updates in the future.

The threat landscape is constantly changing. Going forward, we plan to improve how we share the insights, and plan to share data on a more frequent basis – so that you can have more timely visibility into the latest threat insights. We are committed to continuing our investment in researching and sharing the latest security intelligence with you, as we have for over a decade. This shift in our approach is rooted in a principle that guides Microsoft technology investments: to leverage vast data and unique intelligence to help our customers respond to threats faster.

Here are 3 key findings from the report:

As organizations migrate more and more to the cloud, the frequency and sophistication of attacks on consumer and enterprise accounts in the cloud is growing.

There was a 300 percent increase in Microsoft cloud-based user accounts attacked year-over-year (Q1-2016 to Q1-2017).

The number of account sign-ins attempted from malicious IP addresses has increased by 44 percent year over year in Q1-2017.

Cloud services such as Microsoft Azure are perennial targets for attackers seeking to compromise and weaponize virtual machines and other services, and these attacks are taking place across the globe.

Over two-thirds of incoming attacks on Azure services in Q1-2017 came from IP addresses in China and the United States, at 35.1 percent and 32.5 percent, respectively. Korea was third at 3.1 percent, followed by 116 other countries and regions.

Ransomware is affecting different parts of the world to varying degrees.

Ransomware encounter rates are the lowest in Japan (0.012 percent in March 2017), China (0.014 percent), and the United States (0.02 percent).

Ransomware encounter rates are the highest in Europe vs. the rest of the world in Q1-2017.

Multiple European countries, including the Czech Republic (0.17 percent), Italy (0.14 percent), Hungary (0.14 percent), Spain (0.14 percent), Romania (0.13 percent), Croatia (0.13 percent), and Greece (0.12 percent) had much higher ransomware encounter rates than the worldwide average in March 2017.

Download Volume 22 of the Microsoft Security Intelligence Report today to access additional insights: http://www.microsoft.com/sir" target="_blank" rel="nofollow">.

Click to expand...

Source: Microsoft Security Intelligence Report Volume 22 is now available | Microsoft Secure Blog

Brink · Apr 21, 2020

Stepping up protection with intelligent security

With digital transformation, technology becomes increasingly central to every business and organization. This makes ensuring cybersecurity increasingly important. And, as employees increase their use of mobile devices and cloud-based apps, protecting their work requires a new approach for IT. With 80% of employees admitting to the use of non-approved cloud apps for work, ensuring data protection cannot be left to employees to manage.

To address these needs, Microsoft continues to take a multi-faceted approach to providing built-in security capabilities. These span areas across:

Protecting at the front door

Protecting data anywhere

Achieving data security compliance objectives

Detecting and recovering from attacks

Managing the security tool set

The Microsoft security tools continuously improve with insight from the Microsoft Intelligent Security Graph, which serves as the connective tissue across Microsoft security solutions. Today at Ignite, we are announcing new integrations, expanded capabilities, and partnerships toward addressing the complex areas of cybersecurity for all organizations.

Protect at the front door

The vast majority of security breaches continue to trace back to weak or stolen passwords. Because it’s proving to work, attackers are increasing their focus on stealing passwords to access corporate systems. The latest Microsoft Security Intelligence Report shows a 300 percent increase in user account attacks. To address this growing issue, it is essential to focus on securing identities and access. Our cloud-based approach is through broadly implemented conditional access.

Conditional access enables you to control who has access to your organization’s resources based on a combination of risk factors, such as user account activity, physical location, and the trustworthiness of the device. Azure Active Directory analyzes these factors and applies continuous cybersecurity threat intelligence, powered by Microsoft’s Intelligent Security Graph. This insight provides real-time risk assessment, and triggers the appropriate authentication requirements needed for accessing apps and data. Today, we are expanding conditional access capabilities by integrating with Microsoft Cloud App Security, Azure Information Protection, and our partners in the ecosystem:

Microsoft Cloud App Security performs real-time monitoring and helps IT gain control over cloud apps and how employees use these apps. Now with Cloud App Security, users’ actions taken in cloud applications can be managed and controlled based on conditional access policies and proxy-enforced session restrictions. For example, you can allow users to access cloud apps from an unfamiliar location or unmanaged device, but prevent them from downloading documents.

To further enhance security at the file level, we’re introducing conditional access for sensitive files. With the integration of Azure Information Protection and Azure Active Directory, conditional access can be set up to allow or block access to documents protected with Azure Information Protection. You can also enforce additional security requirements such as multi-factor authentication or device enrollment.

Not only are we providing better integration within our own solutions to deliver holistic and identity-driven security, we also are working with our partners to extend conditional access in the ecosystem. In addition to Azure multi-factor authentication (MFA), you can now use RSA, Duo or Trusona for two-step authentication as part of your conditional access policy.

Protect your data anywhere

Employees are using more SaaS apps, creating more data, and working across multiple devices. While this has enabled people to do more, it has also increased the risk of data loss – it is estimated that 58% of workers have accidentally shared sensitive data with the wrong person.

Microsoft’s Information Protection solutions help you detect, classify, protect and monitor your data – regardless of where it is stored or shared. Today, we’re announcing several new investments in the integration across our information protection solutions – helping provide more comprehensive protection across the data lifecycle.

A key part of this vision is to provide a more consistent and integrated classification, labeling and protection approach across our information protection technologies, enabling persistent protection of your data – everywhere. Microsoft Cloud App Security natively integrates with Azure Information Protection to classify and label files that reside in cloud applications.

Finally, we are announcing the general availability of improvements to Office 365 message encryption, which makes it easier to share protected emails with anybody – inside or outside of your organization. Recipients can view protected Office 365 emails on a variety of devices, using common email clients or even consumer email services such as Gmail and Outlook.com.

Achieve your data security compliance objectives

Regulated organizations have additional needs to demonstrate compliance, and we’re investing in tools to help achieve those goals.

Customer Key can help regulated customers meet their security compliance obligations by providing added control and management of encryption keys. To learn more, check out this of how Customer Key works in SharePoint Online.

Beyond just security compliance, achieving organizational compliance is a complex challenge. It’s hard to stay up-to-date with all the regulations that matter to your organization, and to define and implement controls with limited in-house capability. We’re pleased to introduce the upcoming preview of Compliance Manager, which enables you to manage your compliance posture from one place and stay up-to-date on evolving data protection regulations. Compliance Manager enables real-time risk assessment with one intelligent score reflecting your compliance posture against data protection regulations when using Microsoft cloud services. It also provides recommended actions and step-by-step guidance to help you improve your compliance posture.

Detect and recover from attacks

On average breaches exist for over 90 days in a customer’s environment before they are detected. In response, many organizations are moving to an assume breach posture. We continue to invest in tools that help detect attacks sooner and then remediate. But, we know it’s also important to continue investing in pre-breach attack prevention tools.

Today, we are announcing several new capabilities to further improve our anti-phishing capabilities in Office 365 Advanced Threat Protection, with a focus on mitigating content phishing, domain spoofing, and impersonation campaigns. Office 365 Advanced Threat Protection is also expanded to help secure SharePoint Online, OneDrive for business, and Teams. In Office 365 Threat Intelligence, we have introduced threat insights and tracking to help with detection and remediation. In Windows, we are adding Windows Defender Application Control, which is powered by the Microsoft Intelligent Security Graph to make it less likely that malicious code can run on the endpoint.

On the post-breach detection side, we are announcing the limited preview of a brand-new service – Azure Advanced Threat Protection for users – that brings our on-premises identity threat detection capabilities to the cloud and integrates them with the Microsoft Intelligent Security Graph. Powered by the graph, our Advanced Threat Protection products have a unified view of security event data so your security operations analysts can investigate an incident from endpoint to end-user to e-mail. Finally, as previously announced earlier in the month, Windows Defender Advanced Threat Protection is integrating Hexadite’s AI technology to automatically investigate new alerts, determine the complexity of a threat, and take the necessary actions to remediate it.

Security management

Protecting resources across distributed infrastructure against evolving cyberthreats demands a new approach to security management – a solution that provides comprehensive visibility, consistent controls and actionable intelligence and guidance.

We are announcing today that Azure Security Center, which helps customers protect workloads running in Azure against cybersecurity threats, can now also be used to secure workloads running on-premises and in other private and public clouds. Azure Security Center reduces management complexity by delivering visibility and control over workloads across clouds, enables adaptive threat prevention to reduce your exposure to threats, and provides intelligent detection to help you keep pace with rapidly evolving cyberattacks.

Azure Security Center also has new capabilities to enable central management of security policies, better detect and defend against advanced threats, and streamline investigation of threats for your hybrid workloads. Read the Azure blog to learn more about these and other new features.

Getting started

We have made it easier than ever to get end-to-end security solutions up and running. FastTrack for Microsoft 365 now provides deployment services for key security scenarios, giving you the resources, tools, and support you need from Microsoft engineers.

FastTrack for Microsoft 365 can work with you directly, work with your existing partner, or help you get matched with a trusted Microsoft partner to deploy comprehensive security solutions. And the best part is this isn’t a one-time benefit. It is a repeatable resource that you can use to ensure you have the help and resources you need.

You can go to fasttrack.microsoft.com and get help to deploy Microsoft products to address some of the most common security scenarios including:

Working securely from anywhere, anytime on almost any device enabling a flexible workstyle

Protect your data on files, apps and devices within and across orgs

Detect and protect against external threats

Protect your users and their accounts

Securely collaborate on documents in real time

Julia White
Corporate Vice President, Microsoft Azure & Security
Click to expand...

Source: Stepping up protection with intelligent security | Microsoft Secure Blog

Brink · Apr 21, 2020

Announcing Microsoft Threat Experts

We’re excited to introduce Microsoft Threat Experts, an additional layer of expertise and optics that Microsoft customers can utilize to augment security operations capabilities as part of Microsoft 365. This new managed threat hunting service in Windows Defender Advanced Threat Protection provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately.

Microsoft Threat Experts enables SOCs to jump-start threat investigations by providing context-rich intelligence. This release of the service includes 2 capabilities:

Targeted attack notifications: Alerts that are tailored to organizations provide as much information as can be quickly delivered to bring attention to critical threats in their network, including the timeline, scope of breach, and the methods of intrusion.

Experts on demand: When a threat exceeds the SOC’s capability to investigate, or when more actionable information is needed, security experts provide technical consultation on relevant detections and adversaries. In cases where a full incident response becomes necessary, seamless transition to Microsoft incident response (IR) services is available.

hMYOb81kDYE
Microsoft Threat Experts

With Microsoft Threat Experts, SOCs can further improve defenses by tapping into our world-class security analysts. These experts deeply understand the security landscape and attacker techniques, have intimate knowledge of operating systems, and know how to get the most out of Windows Defender ATP’s features and capabilities. Our experience in battling attackers across more than a billion devices worldwide, together with the artificial intelligence (AI) necessary to harness such unprecedented optics and scale, makes our expert team unique and unmatched in the industry.

The next sections describe the two components of this new service in more detail.

Targeted attack notifications

Microsoft Threat Experts provides proactive hunting for the most important threats, such as human adversary intrusions, hands-on-keyboard attacks, and advanced attacks like cyberespionage. The managed threat hunting service includes:

Threat monitoring and analysis, reducing attacker dwell time and risk to business

Hunter-trained AI to discover and prioritize both known and unknown attacks

Identifying the most important risks, helping SOCs maximize time and energy

Scope of compromise and as much context as can be quickly delivered to enable fast SOC response

Custom Threat Experts alert in Windows Defender Security Center

Experts on demand

Customers can partner with Microsoft security experts, who can be engaged directly from within Windows Defender Security Center, for timely and accurate response. Experts provide insights needed to better understand complex threats, from the latest zero-day exploit to the root cause of a suspicious network connection. Through Microsoft Threat Experts, customers can:

Get additional clarification on alerts including root cause or scope of the incident

Gain clarity into suspicious machine behavior and recommended next steps if faced with an advanced attacker

Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques

Seamlessly transition to Microsoft Incident Response (IR) services when necessary

Ask a Threat Expert button in Windows Defender Security Center

Partnership for improved security

In today’s climate of cybersecurity challenges, organizations must fend off relentless attacks even as they go through their journey of building and maturing their security capabilities. Through Microsoft Threat Experts, customers can partner with Microsoft throughout this journey to augment security operations capabilities to prevent, detect, and respond to threats. Customers and Microsoft can build upon each other’s expertise, intelligence, and insight through this partnership, forming stronger defense against adversaries.

To illustrate the depth of intelligence and the value of the service to customers’ security defenses and overall security posture, we published two case studies for Microsoft Threat Experts on (1) human adversary-based activities related to a zero-day vulnerability and (2) complex “living off the land” threats.

Windows Defender ATP customers can now apply for preview through the Windows Defender Security Center. We will contact customers via email to confirm their participation.

Not yet reaping the benefits of Windows Defender ATP’s industry-leading optics and detection capabilities? Sign up for free trial today.
Click to expand...

Source: Announcing Microsoft Threat Experts - Microsoft Security

See also: Microsoft Threat Experts: Case studies for managed threat hunting service - Microsoft Tech Community - 358244

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Windows 10: Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence...

Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence...

Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence...

Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence...

Does anyone know what the "FriendlyFiles" threat is that Microsoft Security Intelligence... - Similar Threads - Does anyone FriendlyFiles

Does anyone know what this is?

Does anyone know what this is?

Does anyone know what this is?

Does anyone know what is this?

Does anyone know what this bug is?

Does anyone knows what is it?

Does anyone know what this mean's?

Does anyone know what this is?

Cloud App Security threat intelligence