{"id":76142,"date":"2018-01-10T06:00:31","date_gmt":"2018-01-10T14:00:31","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=76142"},"modified":"2023-05-15T22:57:52","modified_gmt":"2023-05-16T05:57:52","slug":"a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/","title":{"rendered":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017"},"content":{"rendered":"<p>Adopting reliable attack methods and techniques borrowed from more evolved threat types, <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/ransomware?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">ransomware<\/a> attained new levels of reach and damage in 2017. The following trends characterize the ransomware narrative in the past year:<\/p>\n<ul>\n<li>Three global outbreaks showed the force of ransomware in making real-world impact, affecting corporate networks and bringing down critical services like hospitals, transportation, and traffic systems<\/li>\n<li>Three million unique computers encountered ransomware; millions more saw downloader trojans, exploits, emails, websites and other components of the ransomware kill chain<\/li>\n<li>New attack vectors, including compromised supply chain, exploits, phishing emails, and documents taking advantage of the DDE feature in Office were used to deliver ransomware<\/li>\n<li>More than 120 new ransomware families, plus countless variants of established families and less prevalent ransomware caught by heuristic and generic detections, emerged from a thriving cybercriminal enterprise powered by ransomware-as-a-service<\/li>\n<\/ul>\n<p>The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-78146 aligncenter\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\" alt=\"\" width=\"850\" height=\"443\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png 850w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7-300x156.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7-768x400.png 768w\" sizes=\"(max-width: 850px) 100vw, 850px\" \/><\/p>\n<p><em>Figure 1. Ransomware encounter rates on Windows 7 and Windows 10 devices. Encounter rate refers to the percentage of computers running the OS version with Microsoft real-time security that blocked or detected ransomware.<\/em><\/p>\n<p>The data shows that attackers are targeting Windows 7. Given today\u2019s modern threats, older platforms can be infiltrated more easily because these platforms don\u2019t have the advanced built-in end-to-end defense stack available on Windows 10. Continuous enhancements further make Windows 10 more resilient to ransomware and other types of attack.<\/p>\n<h2>Windows 10: Multi-layer defense against ransomware attacks<\/h2>\n<p>The year 2017 saw three global ransomware outbreaks driven by multiple propagation and infection techniques that are not necessarily new but not typically observed in ransomware. While there are technologies available on Windows 7 to mitigate attacks, Windows 10\u2019s comprehensive set of platform mitigations and next-generation technologies cover these attack methods. Additionally, <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-10-s?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows 10 S<\/a>, which is a configuration of Windows 10 that\u2019s streamlined for security and performance, locks down devices against ransomware outbreaks and other threats.<\/p>\n<p>In May, <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/05\/12\/wannacrypt-ransomware-worm-targets-out-of-date-systems\/\" target=\"_blank\" rel=\"noopener noreferrer\">WannaCry<\/a> (<a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Ransom:Win32\/WannaCrypt\" target=\"_blank\" rel=\"noopener noreferrer\">Ransom:Win32\/WannaCrypt<\/a>) caused the first global ransomware outbreak. It used EternalBlue, an exploit for a previously fixed SMBv1 vulnerability, to infect computers and spread across networks at speeds never before observed in ransomware.<\/p>\n<p>On Windows 7, <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/device-security\/applocker\/applocker-overview?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows AppLocker<\/a> and antimalware solutions like Microsoft Security Essentials and System Center Endpoint Protection (SCEP) can block the infection process. However, because WannaCry used an exploit to spread and infect devices, networks with vulnerable Windows 7 devices fell victim. The WannaCry outbreak highlighted the importance of keeping platforms and software up-to-date, especially with critical security patches.<\/p>\n<p>Windows 10 was not at risk from the WannaCry attack. Windows 10 has security technologies that can block the WannaCry ransomware and its spreading mechanism. Built-in exploit mitigations on Windows 10 (KASLR, NX HAL, and PAGE POOL), as well as kCFG (control-flow guard for kernel) and HVCI (kernel code-integrity), make Windows 10 much more difficult to exploit.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-78158 aligncenter\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/uploads\/2018\/01\/windows-10-defenses-wannacry.png\" alt=\"\" width=\"1000\" height=\"483\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-wannacry.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-wannacry-300x145.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-wannacry-768x371.png 768w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<p><em>Figure 2. Windows 7 and Windows 10 platform defenses against WannaCry<\/em><\/p>\n<p>In June, <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/06\/27\/new-ransomware-old-techniques-petya-adds-worm-capabilities\/\" target=\"_blank\" rel=\"noopener noreferrer\">Petya<\/a> (<a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Ransom:Win32\/Petya.B\" target=\"_blank\" rel=\"noopener noreferrer\">Ransom:Win32\/Petya.B<\/a>) used the same exploit that gave WannaCry its spreading capabilities, and added more propagation and infection methods to give birth to arguably the most complex ransomware in 2017. Petya\u2019s initial infection vector was a compromised software supply chain, but the ransomware quickly spread using the EternalBlue and EternalRomance exploits, as well as a module for lateral movement using stolen credentials.<\/p>\n<p>On Windows 7, Windows AppLocker can stop Petya from infecting the device. If a Windows 7 device is fully patched, Petya\u2019s exploitation behavior did not work. However, Petya also stole credentials, which it then used to spread across networks. Once running on a Windows 7 device, only an up-to-date antivirus that had protection in place at zero hour could stop Petya from encrypting files or tampering with the master boot record (MBR).<\/p>\n<p>On the other hand, on Windows 10, Petya had more layers of defenses to overcome. Apart from Windows AppLocker, <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/10\/23\/introducing-windows-defender-application-control\/?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Application Control<\/a> can block Petya\u2019s entry vector (i.e., compromised software updater running an untrusted binary), as well as the propagation techniques that used untrusted DLLs. Windows 10\u2019s built-in exploit mitigations can further protect Windows 10 devices from the Petya exploit. <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/access-protection\/credential-guard\/credential-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Credential Guard<\/a> can prevent Petya from stealing credentials from local security authority subsystem service (LSASS), helping curb the ransomware\u2019s propagation technique. Meanwhile, <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/10\/23\/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard\/?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender System Guard (Secure Boot)<\/a> can stop the MBR modified by Petya from being loaded at boot time, preventing the ransomware from causing damage to the master file table (MFT).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-78155 aligncenter\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/uploads\/2018\/01\/windows-10-defenses-petya.png\" alt=\"\" width=\"1000\" height=\"713\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-petya.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-petya-300x214.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-petya-768x548.png 768w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<p><em>Figure 3. Windows 7 and Windows 10 platform defenses against Petya<\/em><\/p>\n<p>In October, another sophisticated ransomware reared its ugly head: Bad Rabbit ransomware (<a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Ransom:Win32\/Tibbar.A\" target=\"_blank\" rel=\"noopener noreferrer\">Ransom:Win32\/Tibbar.A<\/a>) infected devices by posing as an Adobe Flash installer available for download on compromised websites. Similar to WannaCry and Petya, Bad Rabbit had spreading capabilities, albeit more traditional: it used a hardcoded list of user names and passwords. Like Petya, it can also render infected devices unbootable, because, in addition to encrypting files, it also encrypted entire disks.<\/p>\n<p>On Windows 7 devices, several security solutions technologies can block the download and installation of the ransomware, but protecting the device from the damaging payload and from infecting other computers in the network can be tricky.<\/p>\n<p>With Windows 10, however, in addition to stronger defense at the infection vector, corporate networks were safer from this damaging threat because several technologies are available to stop or detect Bad Rabbit\u2019s attempt to spread across networks using exploits or hardcoded user names and passwords.<\/p>\n<p>More importantly, during the Bad Rabbit outbreak, detonation-based machine learning models in <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-defender?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender AV<\/a> cloud protection service, with no human intervention, correctly classified the malware <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/12\/11\/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses\/?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">14 minutes after the very first encounter<\/a>. The said detonation-based ML models are a part of several layers of machine learning and artificial intelligence technologies that evaluate files in order to reach a verdict on suspected malware. Using this layered approach, Windows Defender AV protected Windows 10 devices with cloud protection enabled from Bad Rabbit within minutes of the outbreak.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-78152 aligncenter\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/uploads\/2018\/01\/windows-10-defenses-bad-rabbit.png\" alt=\"\" width=\"1000\" height=\"641\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-bad-rabbit.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-bad-rabbit-300x192.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/windows-10-defenses-bad-rabbit-768x492.png 768w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<p><em>Figure 4. Windows 7 and Windows 10 platform defenses against Bad Rabbit<\/em><\/p>\n<p>As these outbreaks demonstrated, ransomware has indeed become a highly complex threat that can be expected to continue evolving in 2018 and beyond. The multiple layers of next-generation security technologies on Windows 10 are designed to disrupt the attack methods that we have previously seen in highly specialized malware but now also see in ransomware.<\/p>\n<h2>Ransomware protection on Windows 10<\/h2>\n<p>For end users, the dreaded ransom note announces that ransomware has already taken their files hostage: documents, precious photos and videos, and other important files encrypted. On Windows 10 Fall Creators Update, a new feature helps stop ransomware from accessing important files in real-time, even if it manages to infect the computer. When enabled, <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/10\/23\/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Controlled folder access<\/a> locks down folders, allowing only authorized apps to access files.<\/p>\n<p>Controlled folder access, however, is but one layer of defense. Ransomware and other threats from the web can be blocked by <a href=\"https:\/\/docs.microsoft.com\/en-us\/microsoft-edge\/deploy\/index?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Edge<\/a>, whose exploit mitigation and sandbox features make it a very secure browser. Microsoft Edge significantly improves web security by using Windows Defender SmartScreen\u2019s reputation-based blocking of malicious downloads and by opening pages within low-privilege app containers.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-defender?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Antivirus<\/a> also continues to enhance defense against threats like ransomware. Its advanced generic and heuristic techniques and layered machine learning models help catch both common and rare ransomware families. Windows Defender AV can detect and block most malware, including never-before-seen ransomware, using generics and heuristics, local ML models, and metadata-based ML models in the cloud. In rare cases that a threat slips past these layers of protection, Windows Defender AV can protect \u201cpatient zero\u201d in real-time using analysis-based ML models, as demonstrated in a real-life case scenario where a customer was <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/07\/18\/windows-defender-antivirus-cloud-protection-service-advanced-real-time-defense-against-never-before-seen-malware\/?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">protected from a very new Spora ransomware in a matter of seconds<\/a>. In even rarer cases of inconclusive initial classification, additional automated analysis and ML models can still protect customers within minutes, as what happened during the Bad Rabbit outbreak.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-10-s?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows 10 S<\/a> locks down devices from unauthorized content by working exclusively with apps from the Windows Store and by using Microsoft Edge as the default browser. This streamlined, Microsoft-verified platform seals common entry points for ransomware and other threats.<\/p>\n<h2>Reducing the attack surface for ransomware and other threats in corporate networks<\/h2>\n<p>For enterprises and small businesses, the impact of ransomware is graver. Losing access to files can mean disrupted operations. Big enterprise networks, including critical infrastructures, fell victim to ransomware outbreaks. The modern enterprise network is under constant assault by attackers and needs to be defended on all fronts.<\/p>\n<p><a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/10\/23\/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware\/?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Exploit Guard<\/a> locks down devices against a wide variety of attack vectors. Its host intrusion prevention capabilities include the following components, which block behaviors commonly used in malware attacks:<\/p>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/threat-protection\/windows-defender-exploit-guard\/attack-surface-reduction-exploit-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Attack Surface Reduction (ASR)<\/a> is a set of controls that blocks common ransomware entry points: Office-, script-, and email-based threats that download and install ransomware; ASR can also protect from emerging exploits like <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Exploit:O97M\/DDEDownloader.A\" target=\"_blank\" rel=\"noopener noreferrer\">DDEDownloader<\/a>, which has been used to distribute ransomware<\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/threat-protection\/windows-defender-exploit-guard\/network-protection-exploit-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Network protection<\/a> uses Windows Defender SmartScreen to block outbound connections to untrusted hosts, such as when trojan downloaders connect to a malicious server to obtain ransomware payloads<\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/threat-protection\/windows-defender-exploit-guard\/controlled-folders-exploit-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Controlled folder access<\/a> blocks ransomware and other untrusted processes from accessing protected folders and encrypting files in those folders<\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/threat-protection\/windows-defender-exploit-guard\/exploit-protection-exploit-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Exploit protection<\/a> (replacing EMET) provides mitigation against a broad set of exploit techniques that are now being used by ransomware authors<\/li>\n<\/ul>\n<p>Additionally, the industry-best browser security in Microsoft Edge is enhanced by <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/10\/23\/making-microsoft-edge-the-most-secure-browser-with-windows-defender-application-guard?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Application Guard<\/a>, which brings Azure cloud grade isolation and security segmentation to Windows applications. This hardware isolation-level capability provides one of the highest levels of protection against zero-day exploits, unpatched vulnerabilities, and web-based malware.<\/p>\n<p>For emails, <a href=\"https:\/\/products.office.com\/en-us\/exchange\/exchange-email-security-spam-protection?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Exchange Online Protection (EOP)<\/a> uses built-in anti-spam filtering capabilities that help protect Office 365 customers against ransomware attacks that begin with email. <a href=\"https:\/\/products.office.com\/en-us\/exchange\/online-email-threat-protection?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Office 365 Advanced Threat Protection<\/a> helps secure mailboxes against email attacks by blocking emails with unsafe attachments, malicious links, and linked-to files leveraging time-of-click protection.<\/p>\n<h2>Integrated security for enterprises<\/h2>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/windowsforbusiness\/windows-atp?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Advanced Threat Protection<\/a> allows SecOps personnel to stop the spread of ransomware through <a href=\"https:\/\/blogs.technet.microsoft.com\/mmpc\/2017\/01\/30\/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp\/\" target=\"_blank\" rel=\"noopener noreferrer\">timely detection of ransomware activity in the network<\/a>. Windows Defender ATP\u2019s enhanced behavioral and machine learning detection libraries flag malicious behavior across the ransomware attack kill-chain, enabling SecOps to promptly investigate and respond to ransomware attacks.<\/p>\n<p>With Windows 10 Fall Creators Update, Windows Defender ATP was expanded to include seamless integration across the entire Windows protection stack, including Windows Defender Exploit Guard, Windows Defender Application Guard, and Windows Defender AV. This integration is designed to provide a single pane of glass for a seamless security management experience.<\/p>\n<p>To test how Windows Defender ATP can help your organization detect, investigate, and respond to advanced attacks, <strong><a href=\"https:\/\/www.microsoft.com\/en-us\/windowsforbusiness\/windows-atp?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">sign up for a free trial<\/a><\/strong>.<\/p>\n<p>With all of these security technologies, Microsoft has built the most secure Windows version ever with <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/get-windows-10?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Windows 10<\/a>. While the threat landscape will continue to evolve in 2018 and beyond, we don\u2019t stop innovating and investing in security solutions that continue to harden Windows 10 against attacks. The twice-per-year feature update release cycle reflects our commitment to innovate and to make it easier to disrupt successful attack techniques with new protection features. <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/get-windows-10?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener noreferrer\">Upgrading to Windows 10<\/a> not only means decreased risk; it also means access to advanced, multi-layered defense against ransomware and other types of modern attacks.<\/p>\n<p><strong>Tanmay Ganacharya<\/strong> (<a href=\"https:\/\/twitter.com\/tanmayg\" target=\"_blank\" rel=\"noopener noreferrer\">@tanmayg<\/a>)<br \/>\nPrincipal Group Manager, Windows Defender Research<\/p>\n<p>*Edited 01\/11\/2018 to remove the statement &#8220;Windows 10 has a much larger install base than Windows 7<b><\/b>&#8220;.<\/p>\n<hr \/>\n<h4><strong>Talk to us<\/strong><\/h4>\n<p>Questions, concerns, or insights on this story? Join discussions at the <a href=\"https:\/\/answers.microsoft.com\/en-us\/protect\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft community<\/a> and <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Security Intelligence<\/a>.<\/p>\n<p>Follow us on Twitter <a href=\"https:\/\/twitter.com\/WDSecurity\" target=\"_blank\" rel=\"noopener noreferrer\">@WDSecurity<\/a> and Facebook <a href=\"https:\/\/www.facebook.com\/MsftWDSI\/\" target=\"_blank\" rel=\"noopener noreferrer\">Windows Defender Security Intelligence<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Adopting reliable attack methods and techniques borrowed from more evolved threat types, ransomware attained new levels of reach and damage in 2017. The following trends characterize the ransomware narrative in the past year: Three global outbreaks showed the force of ransomware in making real-world impact, affecting corporate networks and bringing down critical services like hospitals, [&hellip;]<\/p>\n","protected":false},"author":61,"featured_media":78146,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3664,3688,3689],"products":[3690],"threat-intelligence":[],"tags":[3802,3819],"coauthors":[1949],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Adopting reliable attack methods and techniques borrowed from more evolved threat types, ransomware attained new levels of reach and damage in 2017. The following trends characterize the ransomware narrative in the past year: Three global outbreaks showed the force of ransomware in making real-world impact, affecting corporate networks and bringing down critical services like hospitals, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2018-01-10T14:00:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T05:57:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\" \/>\n\t<meta property=\"og:image:width\" content=\"850\" \/>\n\t<meta property=\"og:image:height\" content=\"443\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Tanmay Ganacharya\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tanmay Ganacharya\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/tanmay-ganacharya\/\",\"@type\":\"Person\",\"@name\":\"Tanmay Ganacharya\"}],\"headline\":\"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017\",\"datePublished\":\"2018-01-10T14:00:31+00:00\",\"dateModified\":\"2023-05-16T05:57:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\"},\"wordCount\":1940,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\",\"keywords\":[\"Ransomware\",\"Windows\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\",\"name\":\"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\",\"datePublished\":\"2018-01-10T14:00:31+00:00\",\"dateModified\":\"2023-05-16T05:57:52+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png\",\"width\":850,\"height\":443},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/","og_locale":"en_US","og_type":"article","og_title":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog","og_description":"Adopting reliable attack methods and techniques borrowed from more evolved threat types, ransomware attained new levels of reach and damage in 2017. The following trends characterize the ransomware narrative in the past year: Three global outbreaks showed the force of ransomware in making real-world impact, affecting corporate networks and bringing down critical services like hospitals, [&hellip;]","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/","og_site_name":"Microsoft Security Blog","article_published_time":"2018-01-10T14:00:31+00:00","article_modified_time":"2023-05-16T05:57:52+00:00","og_image":[{"width":850,"height":443,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png","type":"image\/png"}],"author":"Tanmay Ganacharya","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Tanmay Ganacharya","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/tanmay-ganacharya\/","@type":"Person","@name":"Tanmay Ganacharya"}],"headline":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017","datePublished":"2018-01-10T14:00:31+00:00","dateModified":"2023-05-16T05:57:52+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/"},"wordCount":1940,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png","keywords":["Ransomware","Windows"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/","name":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017 | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png","datePublished":"2018-01-10T14:00:31+00:00","dateModified":"2023-05-16T05:57:52+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/Ransomware-encounter-rate-Windows-10-vs-7.png","width":850,"height":443},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/76142"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=76142"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/76142\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/78146"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=76142"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=76142"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=76142"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=76142"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=76142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=76142"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=76142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}