Select Page
Attack chain diagram

Analysis of a targeted attack exploiting the WinRar CVE-2018-20250 vulnerability

In early March, we discovered a cyberattack that used an exploit for CVE-2018-20250, an old WinRar vulnerability disclosed just several weeks prior, and targeted organizations in the satellite and communications industry. A complex attack chain incorporating multiple code execution techniques ... continue reading
Using PowerShell script make any application highly available

Using PowerShell script make any application highly available

First published on MSDN on Jun 06, 2016 Author: Amitabh Tamhane Senior Program Manager Windows Server Microsoft OS releases: Applicable to Windows Server 2008 R2 or later Now you can use PowerShell scripts to make any application highly available with ... continue reading
Confidential computing using Always Encrypted with secure enclaves in SQL Server 2019 preview

Confidential computing using Always Encrypted with secure enclaves in SQL Server 2019 preview

SQL Server 2019 preview brings encryption technology to a broader set of scenarios by enabling rich confidential computing capabilities with the enhanced Always Encrypted feature, Always Encrypted with secure enclaves. Always Encrypted with secure enclaves allows rich computations on encrypted ... continue reading

Security baseline (FINAL) for Windows 10 v1809 and Windows Server 2019

Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 October 2018 Update (a.k.a., version 1809, “Redstone 5” or “RS5”), and for Windows Server 2019. Download the content from the Microsoft Security Compliance ... continue reading
Everything you need to know about Windows Server 2019 – Part 3

Everything you need to know about Windows Server 2019 – Part 3

This blog post was authored by Dean Wells, Principal Program Manager, Windows Server. In the preceding blogs, you were given a video-tour of some of the high-level advancements made in Windows Server 2019 that touched on areas such as the ... continue reading
Protecting the protector: Hardening machine learning defenses against adversarial attacks

Protecting the protector: Hardening machine learning defenses against adversarial attacks

Harnessing the power of machine learning and artificial intelligence has enabled Windows Defender Advanced Threat Protection (Windows Defender ATP) next-generation protection to stop new malware attacks before they can get started often within milliseconds. These predictive technologies are central to ... continue reading
Hawkeye Keylogger – Reborn v8: An in-depth campaign analysis

Hawkeye Keylogger – Reborn v8: An in-depth campaign analysis

Much of cybercrime today is fueled by underground markets where malware and cybercriminal services are available for purchase. These markets in the deep web commoditize malware operations. Even novice cybercriminals can buy malware toolkits and other services they might need ... continue reading
Taking apart a double zero-day sample discovered in joint hunt with ESET

Taking apart a double zero-day sample discovered in joint hunt with ESET

In late March 2018, I analyzed an interesting PDF sample found by ESET senior malware researcher Anton Cherpanov. The sample was initially reported to Microsoft as a potential exploit for an unknown Windows kernel vulnerability. During my investigation in parallel ... continue reading
Building Zero Trust networks with Microsoft 365

Building Zero Trust networks with Microsoft 365

The traditional perimeter-based network defense is obsolete. Perimeter-based networks operate on the assumption that all systems within a network can be trusted. However, todays increasingly mobile workforce, the migration towards public cloud services, and the adoption of Bring Your Own ... continue reading
Virtualization-based security (VBS) memory enclaves: Data protection through isolation

Virtualization-based security (VBS) memory enclaves: Data protection through isolation

The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote ... continue reading