Skip to main content
Microsoft Security

Microsoft Defender Security Research Team Posts

Microsoft Defender Security Research Team
Worker behind a desk.

Behavioral blocking and containment: Transforming optics into protection 

Behavioral blocking and containment capabilities leverage multiple Microsoft Defender ATP components and features to immediately stop attacks before they can progress. We have expanded these capabilities to get even broader visibility into malicious behavior by using a rapid protection loop engine that leverages endpoint and detection response (EDR) sensors.

Published
11 min read

Insights from one year of tracking a polymorphic threat 

We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in general.