Welcome to Microsoft Mechanics.
Coming up on the show we're going to explore the security across your email
on endpoints of the unified advanced threat protection experience
across Office and Windows.
We look at the spectrum of defense's across known and unknown attacks,
including the filters in place to stop known threats in real-time,
near real-time threat removal ahead of broad impact,
and the discovery investigation containment and response
to advanced threats that make it through all prior defenses.
Microsoft Mechanics
So I'm joined today by a Heike Ritter, welcome.
Great to be back on Mechanics.
So with advanced threat protection Office 365 in Windows,
our goal is really to stop or contain more sophisticated cyber attacks.
As you can see on the respective dashboards in Office 365
we had additional security by discovering and removing unsafe attachments
and blocking traffic to unsafe hyperlinks.
Or linked to files arriving in the body of emails.
And in Windows, if a threat lands on an endpoint
Windows Defender ATP collects behaviors to detect threats that might make it through
email filters, the browser, antivirus or other defenses.
Using the Windows Defender ATP console then helps security operators
investigate and understand the scope of a potential breach.
And contain and respond to threats to prevent a limit damage.
It's really great to see a unified approach for security across your endpoints
and services that it's now possible.
That's right and a few things we're needed to happen to make that possible.
We think about threats in two broad categories.
Known and unknown threats.
And we are constantly improving the means to detect new threats .
At the heart of this intelligence collections
is the Microsoft intelligent security graph.
We collect a vast amount of signals for more than 200 commercial and consumer services.
Think about our email services.
All the endpoints that update on a regular basis.
All the authentications via Azure AD and Microsoft accounts.
URLs and IPs we scan daily through our search engine, Bing.
And more signals including third-party sources are added every minute.
We pause out specific security signals.
Through machine learning and analytics
we can easily identify ddoS attacks and other attacks.
Phishing and spam and suspicious logins and so forth.
This all informs the Microsoft intelligence security graph
which helps us to quickly adopt to changing threats, deploy new defenses, and orchestrate remediation.
So for each information vector we can also help one another.
So for example, if a malicious process is first discovered and Windows Defender ATP
that intelligence can be passed through the security graph into Office 365 ATP.
So you can block subsequent emails that might have that malicious code.
Also similarly on the Office 365 side
we can communicate our intelligence back through the graph in the defender ATP
so we can enhance its detection capabilities.
Yeah and unknown are becoming known every second
to increase the overall security level.
Right, so let's start by walking through Office 365 ATP and show you how that works in action.
So here I'm logged in as Ben Walters.
I've received an email with an attachment from Adele Vance.
Now safe attachments in Office 365 ATP
was able to block it give me a message as to why it was blocked.
But this email is really ambitious in that
it gives me links to a file hosting service for those same files.
But now with URL detonation, we can even block those linked to files
using Office 365 ATP.
Let me hop over into the admin experience,
because here I can go into the dashboard and actually see all of these different activities
right here through the security and compliance Center reporting dashboard.
I have things like DLP policies,
my ATP message disposition,
top senders and recipients of malicious files.
All of those activities and things are here right at finger tips.
While these defenses will prevent most threats from hitting users,
we know that threats are constantly evolving.
For protection of things that might hit your endpoints eventually,
Windows Defender ATP comes in.
That's right, let's have a look at an actual attack
and how Windows Defender ATP detects those attackers.
On the left here you can see our hacker at work.
And on the right, you will see Jonathon, our victim.
Jonathan sees an email he's expecting.
He opens the attachment and enables a macro.
Unknown to him, the macro communicates with a command-and-control
server and downloads and runs code in memory.
The attacker now finds out that he doesn't have enough privileges.
So he runs a kernel level exploit leveraging a vulnerable driver on the system
to gain access to the system token.
And now he applies this system token to Word
and then also injects code into SCV host
which is a trusted process and he enters stealth mode.
And then from there he sees what are the delegations available for this token?
What is the network looking like?
What are the groups?
And what are the different machines that he could probably move to
to then expand on the network.
Next, he is using PowerShell remoting
with Jonathan's credentials and moves to another machine.
So on the other machine
you can see he uses PowerShell remoting, again.
and also communicating to the command and control server and downloads
malicious code and memory and then
gains persistence on this machine as well.
And we can see there with prockmon running that neither of the users was aware of that attack.
Neither the person receiving the mail
or Jay on a second machine.
But how does Windows Defender ATP actually help detect and contain it?
So with the creators update
we brought many new detection capabilities with it
and those are some of them like
in-memory and kernel based attacks.
So let me show you how this actually looks like from a security investigation perspective.
Okay.
Imagine your security operator and you have a seam system
so you can connect Windows Defender ATP and get alerted.
Or you can also get alerted via emails on alert.
So looking at the dashboard I can see many many alerts already.
One especially is on John's machine.
It's the high severity alert and I think I want to start here.
I click on Jonathan's machine
and I'm on the machine timeline.
So everything started here with a vulnerable driver that was loaded, it was not an attack.
But it was abused in that attack.
So abnormal code, privilege escalation, process inject and so on.
So by selecting one of their alerts,
the timeline down here brings me back in time
for when this attack happened
and also marks the Associated events.
I will start as I said with the Red Alert.
So the related event to this was WINWARD, the access token was modified.
By expanding the view you get the entire process tree for this event
and also we have a new details pane which shows you even more details.
In this case the previous integrity level was medium
and the new integrity level is system.
Those are all the additional privileges that got added.
Another alert when we go down in time was abnormal code execution
was observed.
So if I click on the related event for instance
I can see again the entire process tree
of the memory allocation.
Another thing that I would highlight here
was the cross process injection that we saw in the attack
where Word injected into a SCV host.
And If I click on this I can actually see it here
inject into the process.
So we saw already in the events that Outlook started Word
and from there there was a file involved.
So WINORD opened this specific email here.
So let's go back in time a little bit
to find the event that we observed when Outlook saved this attachment.
And further down here you can see Outlook saved an attachment to this
by expanding this event.
I get all the details about this specific email here
already right there and displayed in Windows Defender ATP console.
And guess where this comes from?
That information is coming in from Exchange online?
Exactly.
So with Office 365 ATP,
if a customer has both solutions, you can connect those solutions together
and get some information displayed that we don't know about because we don't look at emails.
Right and the power here is that Windows Defender ATP actually detected the attack.
It can pass that info again on to the intelligent security graph.
And then Office 365 ATP can actually use that detection logic
to block subsequent mails that will further deliver that throughout the organization.
Or organizations broadly that are using Office 365.
Exactly, so if I click on more details
That's exactly what happens.
So I can see in the threat explorer here
that I had more recipients.
So there was a targeted attack not only to Jonathan, but others got this as well.
But because of the security intelligence graph
it got blocked from two other mailboxes.
But anyways I will probably check out those machines to see if
the attackers found a different way to get on those machines.
Obviously they were targeted.
So let's go back and investigate the machine a little further from Jonathan.
I would like to look at another alert that we saw.
It was a suspicious remote shell and if I click on this event
I can see that PowerShell communicated with an external IP address
I'm not too familiar with this IP address, I want to learn more about it.
So I click on it and let's see what we know about it.
All the different events that we saw on various machines that are unmonitored
for the service are all displayed on the same page.
And then if I go back in time and we remember the attack happened
on February 6th.
I can see that two machines actually communicated with this IP addresss.
And also the process.
So Jay Hardy was also a victim.
JD's machine communicated with this IP
so I want to go on JD's machine now and see what else happened.
I can see that all these alerts
are actually under Jonathan Val Kurtz user account.
But on Jay Hardy's machine.
So I think what a security operator would do now.
Next is isolating those machines.
So Jays machines and Jonathan machines.
Those are new capabilities with the creator's update as well.
So I click on action and I can isolate a machine
which would now disconnect this machine from the network.
But let's leave the channel open back to the Windows Defender ATP console
so that the investigator can do additional investigation,
download a forensic package and all of this.
But is there any way or anything I can do to actually block his account?
Not from this console.
For instance, Microsoft Advanced Threat Analytics
is working on an integration here.
So let me show you one of the upcoming features.
If I click on more information
I get directed immediately to Microsoft ATA
which shows me additional information of what ATA knows about this user.
All the abnormal resources that the users being used.
Or abnormal computers.
And from there I can take action.
And we have a whole show dedicated to Advanced Threat Analytics
that was on Microsoft Mechanics a few months back.
So check that out to learn more.
As we saw here we can feedback and protect you across endpoints,
services and even identities like we saw through the integration with ATA
using the Microsoft intelligent security graph.
Now moving back to Office 365
we've recently announced Office 365 Threat Intelligence.
Now this is going to provide you visibility not only into trends within your tenant,
but also trends across the ecosystem.
So here in the threat dashboard I can see things like,
recent alerts, the attack origins and heat maps.
In a threat Explorer view I can also filter down by detection technology within my own tenant.
Here I'm going to use ATP detonation.
When I perform that filter I see all the different activities filtered by ATP detonation.
Now this is actually also looking at things like antivirus and reputation
for some of the links that were detecting as they come in through email.
That's right.
And all of this information feeds back into the Microsoft intelligent security graphs
so that we can collectively improve our defenses.
It's really great to see that we have all multiple layers of intelligence and the visibility
through our tools across endpoints.
And the services to continually strengthen the overall security level
for Office 365 ATP and Windows Defender ATP.
You can learn more and sign up for trials at the link below.
And thanks for joining us today for this overall review of both of these technologies working together.
And also keep watching Microsoft Mechanics for the latest tech updates across Microsoft.
We'll see you soon.
Microsoft Mechanics
www.microsoft.com/mechanics