{"id":80141,"date":"2018-02-14T06:43:26","date_gmt":"2018-02-14T14:43:26","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=80141"},"modified":"2025-02-19T21:13:46","modified_gmt":"2025-02-20T05:13:46","slug":"how-artificial-intelligence-stopped-an-emotet-outbreak","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/","title":{"rendered":"How artificial intelligence stopped an Emotet outbreak"},"content":{"rendered":"\n<p>At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?name=Win32\/Emotet\" target=\"_blank\" rel=\"noopener\">Trojan:Win32\/Emotet<\/a>. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and automatically protected by <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-defender?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">Windows Defender AV<\/a>.<\/p>\n\n\n\n<p>How did Windows Defender AV uncover the newly launched attack and block it at the outset? Through <a href=\"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/2017\/12\/11\/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses\/\" target=\"_blank\" rel=\"noopener\">layered machine learning<\/a>, including use of both client-side and cloud machine learning (ML) models. Every day, artificial intelligence enables Windows Defender AV to stop countless malware outbreaks in their tracks. In this blog post, we\u2019ll take a detailed look at how the combination of client and cloud ML models detects new outbreaks.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"430\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig1-layered-machine-learning-models-funnel-3.png\" alt=\"\" class=\"wp-image-80144\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig1-layered-machine-learning-models-funnel-3.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig1-layered-machine-learning-models-funnel-3-300x129.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig1-layered-machine-learning-models-funnel-3-768x330.png 768w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p><em>Figure 1. Layered detected model in Windows Defender AV<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"client-machine-learning-models\">Client machine learning models<\/h2>\n\n\n\n<p>The first layer of machine learning protection is an array of lightweight ML models built right into the Windows Defender AV client that runs locally on your computer. Many of these models are specialized for file types commonly abused by malware authors, including, JavaScript, Visual Basic Script, and Office macro. Some models target behavior detection, while other models are aimed at detecting portable executable (PE) files (.exe and .dll).<\/p>\n\n\n\n<p>In the case of the <a href=\"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/2017\/11\/06\/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks\/\" target=\"_blank\" rel=\"noopener\">Emotet<\/a> outbreak on February 3, Windows Defender AV caught the attack using one of the PE gradient boosted tree ensemble models. This model classifies files based on a featurization of the assembly opcode sequence as the file is emulated, allowing the model to look at the file\u2019s behavior as it was simulated to run.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"818\" height=\"395\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig2-emulated-execution-opcode.png\" alt=\"\" class=\"wp-image-80147\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig2-emulated-execution-opcode.png 818w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig2-emulated-execution-opcode-300x145.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig2-emulated-execution-opcode-768x371.png 768w\" sizes=\"auto, (max-width: 818px) 100vw, 818px\" \/><\/figure>\n\n\n\n<p><em>Figure 2. A client ML model classified the Emotet outbreak as malicious based on emulated execution opcode machine learning model.<\/em><\/p>\n\n\n\n<p>The tree ensemble was trained using <a href=\"https:\/\/github.com\/Microsoft\/LightGBM\" target=\"_blank\" rel=\"noopener\">LightGBM<\/a>, a Microsoft open-source framework used for high-performance gradient boosting.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"430\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3a-Light-BGM-trained-ensemble-of-20-trees.png\" alt=\"\" class=\"wp-image-80150\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3a-Light-BGM-trained-ensemble-of-20-trees.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3a-Light-BGM-trained-ensemble-of-20-trees-300x129.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3a-Light-BGM-trained-ensemble-of-20-trees-768x330.png 768w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p><em>Figure 3a. Visualization of the LightBGM-trained client ML model that successfully classified Emotet&#8217;s emulation behavior as malicious. A set of 20 decision trees are combined in this model to classify whether the file\u2019s emulated behavior sequence is malicious or not.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"410\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3b-First-Light-BGM-trained-decision-tree.png\" alt=\"\" class=\"wp-image-80153\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3b-First-Light-BGM-trained-decision-tree.png 1000w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3b-First-Light-BGM-trained-decision-tree-300x123.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig3b-First-Light-BGM-trained-decision-tree-768x315.png 768w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<p><em>Figure 3b. A more detailed look at the first decision tree in the model. Each decision is based on the value of a different feature. Green triangles indicate weighted-clean decision result; red triangles indicate weighted malware decision result for the tree.<\/em><\/p>\n\n\n\n<p>When the client-based machine learning model predicts a high probability of maliciousness, a rich set of feature vectors is then prepared to describe the content. These feature vectors include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Behavior during emulation, such as API calls and executed code<\/li>\n\n\n\n<li>Similarity fuzzy hashes<\/li>\n\n\n\n<li>Vectors of content descriptive flags optimized for use in ML models<\/li>\n\n\n\n<li>Researcher-driven attributes, such as packer technology used for obfuscation<\/li>\n\n\n\n<li>File name<\/li>\n\n\n\n<li>File size<\/li>\n\n\n\n<li>Entropy level<\/li>\n\n\n\n<li>File attributes, such as number of sections<\/li>\n\n\n\n<li>Partial file hashes of the static and emulated content<\/li>\n<\/ul>\n\n\n\n<p>This set of features form a signal sent to the Windows Defender AV cloud protection service, which runs a wide array of more complex models in real-time to instantly classify the signal as malicious or benign.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"real-time-cloud-machine-learning-models\">Real-time cloud machine learning models<\/h2>\n\n\n\n<p>Windows Defender AV\u2019s cloud-based real-time classifiers are powerful and complex ML models that use a lot of memory, disk space, and computational resources. They also incorporate global file information and Microsoft reputation as part of the Microsoft Intelligent Security Graph to classify a signal. Relying on the cloud for these complex models has several benefits. First, it doesn\u2019t use your own computer\u2019s precious resources. Second, the cloud allows us to take into consideration the global information and reputation information from the Microsoft Intelligent Security Graph to make a better decision. Third, cloud-based models are harder for cybercriminals to evade. Attackers can take a local client and test our models without our knowledge all day long. To test our cloud-based defenses, however, attackers have to talk to our cloud service, which will allow us to react to them.<\/p>\n\n\n\n<p>The cloud protection service is queried by Windows Defender AV clients billions of times every day to classify signals, resulting in millions of malware blocks per day, and translating to protection for hundreds of millions of customers. Today, the Windows Defender AV cloud protection service has around 30 powerful models that run in parallel. Some of these models incorporate millions of features each; most are updated daily to adapt to the quickly changing threat landscape. All together, these classifiers provide an array of classifications that provide valuable information about the content being scanned on your computer.<\/p>\n\n\n\n<p>Classifications from cloud ML models are combined with ensemble ML classifiers, reputation-based rules, allow-list rules, and data in the&nbsp;Microsoft Intelligent Security Graph to come up with a final decision on the signal. The cloud protection service then replies to the Windows Defender client with a decision on whether the signal is malicious or not \u2013 all in a fraction of a second.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"453\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig4-Windows-Defender-AV-cloud-protections-service-2-1024x453.png\" alt=\"\" class=\"wp-image-80156\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig4-Windows-Defender-AV-cloud-protections-service-2-1024x453.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig4-Windows-Defender-AV-cloud-protections-service-2-300x133.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig4-Windows-Defender-AV-cloud-protections-service-2-768x340.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/02\/Emotet-fig4-Windows-Defender-AV-cloud-protections-service-2.png 1030w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><em>Figure 4. Windows Defender AV cloud protection service workflow.<\/em><\/p>\n\n\n\n<p>In the Emotet outbreak, one of our cloud ML servers in North America received the most queries from customers; corresponding to where the outbreak began. At least nine real-time cloud-based ML classifiers correctly identified the file as malware. The cloud protection service replied to signals instructing the Windows Defender AV client to block the attack using two of our ML-based threat names, <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Trojan:Win32\/Fuerboos.C!cl\" target=\"_blank\" rel=\"noopener\">Trojan:Win32\/Fuerboos.C!cl<\/a> and <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Trojan:Win32\/Fuerboos.C!cl\" target=\"_blank\" rel=\"noopener\">Trojan:Win32\/Fuery.A!cl<\/a>.<\/p>\n\n\n\n<p>This automated process protected customers from the Emotet outbreak in real-time. But Windows Defender AV\u2019s artificial intelligence didn\u2019t stop there.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"deep-learning-on-the-full-file-content\">Deep learning on the full file content<\/h2>\n\n\n\n<p>Automatic sample submission, a Windows Defender AV feature, sent a copy of the malware file to our backend systems less than a minute after the very first encounter. Deep learning ML models immediately analyzed the file based on the full file content and behavior observed during detonation. Not surprisingly, deep neural network models identified the file as a variant of Trojan:Win32\/Emotet, a family of banking Trojans.<\/p>\n\n\n\n<p>While the ML classifiers ensured that the malware was blocked at first sight, deep learning models helped associate the threat with the correct malware family. Customers who were protected from the attack can use this information to understand the impact the malware might have had if it were not stopped.<\/p>\n\n\n\n<p>Additionally, deep learning models provide another layer of protection: in relatively rare cases where real-time classifiers are not able to come to a conclusive decision about a file, deep learning models can do so within minutes. For example, during the Bad Rabbit ransomware outbreak, <a href=\"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/2017\/12\/11\/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses\/?source=mmpc\" target=\"_blank\" rel=\"noopener\">Windows Defender AV protected customers from the new ransomware just 14 minutes after the very first encounter<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"intelligent-real-time-protection-against-modern-threats\">Intelligent real-time protection against modern threats<\/h2>\n\n\n\n<p>Machine learning and AI are at the forefront of the next-gen real-time protection delivered by <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/windows-defender-antivirus-in-windows-10?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">Windows Defender AV<\/a>. These technologies, backed by unparalleled optics into the threat landscape provided by Microsoft Intelligent Security Graph as well as world-class Windows Defender experts and researchers, allow Microsoft security products to quickly evolve and scale to defend against the full range of attack scenarios.<\/p>\n\n\n\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/utilize-microsoft-cloud-protection-windows-defender-antivirus?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">Cloud-delivered protection<\/a> is enabled in Windows Defender AV by default. To check that it\u2019s running, go to Windows Settings &gt; Update &amp; Security &gt; Windows Defender. Click Open Windows Defender Security Center, then navigate to Virus &amp; threat protection &gt; Virus &amp;threat protection settings, and make sure that Cloud-delivered protection and Automatic sample submission are both turned On.<\/p>\n\n\n\n<p>In enterprise environments, the Windows Defender AV cloud protection service can be <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/enable-cloud-protection-windows-defender-antivirus?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">managed<\/a> using Group Policy, System Center Configuration Manager, PowerShell cmdlets, Windows Management Instruction (WMI), Microsoft Intune, or via the Windows Defender Security Center app.<\/p>\n\n\n\n<p>Windows Defender Advanced Threat Protection (<a href=\"https:\/\/www.microsoft.com\/en-us\/windowsforbusiness\/windows-atp?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">Windows Defender ATP<\/a>) integrates protections from Windows Defender AV, Windows Defender Exploit Guard, and Windows Defender Application Guard, providing a seamless security management experience.<\/p>\n\n\n\n<p>To test how Windows Defender ATP can help your organization detect, investigate, and respond to advanced attacks, <strong><a href=\"https:\/\/www.microsoft.com\/en-us\/windowsforbusiness\/windows-atp?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">sign up for a free trial<\/a><\/strong>.<\/p>\n\n\n\n<p>The intelligent real-time defense in Windows Defender AV is part of the next-gen security technologies in Windows 10 that protect against a wide spectrum of threats. Of particular note, <a href=\"https:\/\/www.microsoft.com\/en-us\/windows\/windows-10-s?ocid=cx-blog-mmpc\" target=\"_blank\" rel=\"noopener\">Windows 10 S<\/a> is not affected by this type of malware attack. Threats like Emotet won\u2019t run on Windows 10 S because it exclusively runs apps from the Microsoft Store. <a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4020089\/windows-10-s-faq\" target=\"_blank\" rel=\"noopener\">Learn more about Windows 10 S<\/a>. To know about all the security technologies available in Windows 10, read <a href=\"https:\/\/blogs.windows.com\/business\/2017\/10\/23\/microsoft-365-security-management-features-available-windows-10-fall-creators-update\/?ocid=cx-blog-mmpc#esrvzmUJvQYKhVYz.97\">Microsoft 365 security and management features available in Windows 10 Fall Creators Update<\/a>.<\/p>\n\n\n\n<p><em><strong>Geoff McDonald<\/strong>, Windows Defender Research<\/em><br><em>with Randy Treit and Allan Sepillo<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"talk-to-us\"><strong>Talk to us<\/strong><\/h4>\n\n\n\n<p>Questions, concerns, or insights on this story? Join discussions at the <a href=\"https:\/\/answers.microsoft.com\/en-us\/protect\" target=\"_blank\" rel=\"noopener\">Microsoft community<\/a> and <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\" target=\"_blank\" rel=\"noopener\">Windows Defender Security Intelligence<\/a>.<\/p>\n\n\n\n<p>Follow us on Twitter <a href=\"https:\/\/twitter.com\/WDSecurity\" target=\"_blank\" rel=\"noopener\">@WDSecurity<\/a> and Facebook <a href=\"https:\/\/www.facebook.com\/MsftWDSI\/\" target=\"_blank\" rel=\"noopener\">Windows Defender Security Intelligence<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for Trojan:Win32\/Emotet. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and automatically protected by Windows Defender [&hellip;]<\/p>\n","protected":false},"author":61,"featured_media":79760,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[],"threat-intelligence":[3738],"tags":[],"coauthors":[1968],"class_list":["post-80141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","threat-intelligence-threat-actors","review-flag-1694638272-264","review-flag-1694638265-576","review-flag-1694638265-310","review-flag-1-1694638265-354","review-flag-2-1694638266-864","review-flag-3-1694638266-241","review-flag-4-1694638266-512","review-flag-7-1694638266-851","review-flag-artif-1694638272-22","review-flag-fall-1694638270-285","review-flag-machi-1694638272-641","review-flag-ml-1694638272-297","review-flag-new-1694638263-340"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for Trojan:Win32\/Emotet. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and automatically protected by Windows Defender [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2018-02-14T14:43:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-02-20T05:13:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png\" \/>\n\t<meta property=\"og:image:width\" content=\"500\" \/>\n\t<meta property=\"og:image:height\" content=\"430\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Defender Security Research Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Defender Security Research Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Defender Security Research Team\"}],\"headline\":\"How artificial intelligence stopped an Emotet outbreak\",\"datePublished\":\"2018-02-14T14:43:26+00:00\",\"dateModified\":\"2025-02-20T05:13:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\"},\"wordCount\":1442,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\",\"name\":\"How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png\",\"datePublished\":\"2018-02-14T14:43:26+00:00\",\"dateModified\":\"2025-02-20T05:13:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png\",\"width\":500,\"height\":430},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How artificial intelligence stopped an Emotet outbreak\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/","og_locale":"en_US","og_type":"article","og_title":"How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog","og_description":"At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for Trojan:Win32\/Emotet. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and automatically protected by Windows Defender [&hellip;]","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/","og_site_name":"Microsoft Security Blog","article_published_time":"2018-02-14T14:43:26+00:00","article_modified_time":"2025-02-20T05:13:46+00:00","og_image":[{"width":500,"height":430,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png","type":"image\/png"}],"author":"Microsoft Defender Security Research Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft Defender Security Research Team","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/","@type":"Person","@name":"Microsoft Defender Security Research Team"}],"headline":"How artificial intelligence stopped an Emotet outbreak","datePublished":"2018-02-14T14:43:26+00:00","dateModified":"2025-02-20T05:13:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/"},"wordCount":1442,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/","name":"How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png","datePublished":"2018-02-14T14:43:26+00:00","dateModified":"2025-02-20T05:13:46+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/01\/layered-machine-learning-models-funnel-3-featured.png","width":500,"height":430},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/02\/14\/how-artificial-intelligence-stopped-an-emotet-outbreak\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"How artificial intelligence stopped an Emotet outbreak"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/80141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=80141"}],"version-history":[{"count":1,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/80141\/revisions"}],"predecessor-version":[{"id":137626,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/80141\/revisions\/137626"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/79760"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=80141"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=80141"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=80141"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=80141"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=80141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=80141"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=80141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}