Microsoft Sentinel Archives | Microsoft Security Blog

A man standing in front of a computer screen

April 9, 2025
13 min read

Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI

Exchange Server and SharePoint Server are business-critical assets and considered crown-jewels for many organizations, making them attractive targets for attacks.

Photo of a man sitting at a desk with a laptop

April 3, 2025
13 min read

Threat actors leverage tax season to deploy tax-themed phishing campaigns

As Tax Day approaches in the United States on April 15, Microsoft has detected several tax-themed phishing campaigns employing various tactics.

April 1, 2025
4 min read

Transforming public sector security operations in the AI era

Read how Microsoft’s unified security operations platform can use generative AI to transform cybersecurity for the public sector.

Person sitting on a couch using a laptop.

March 17, 2025
13 min read

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

Microsoft Incident Response uncovered a novel remote access trojan (RAT) named StilachiRAT, which demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.

Photo of a man holding a tablet and luggage with blue hexagons and the icon for Storm threat actors

March 13, 2025
10 min read

Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware

Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking.

A group of people looking at a computer screen

February 13, 2025
10 min read

Storm-2372 conducts device code phishing campaign

Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372.

February 12, 2025
23 min read

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation

Microsoft is publishing for the first time our research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the “BadPilot campaign”.

Photo of a developer coding her workspace in an enterprise office, using Visual Studio on a multi-monitor set up.

February 6, 2025
11 min read

Code injection attacks using publicly disclosed ASP.NET machine keys

Microsoft Threat Intelligence observed limited activity by an unattributed threat actor using a publicly available, static ASP.

January 16, 2025
7 min read

New Star Blizzard spear-phishing campaign targets WhatsApp accounts

In mid-November 2024, Microsoft Threat Intelligence observed the Russian threat actor we track as Star Blizzard sending their typical targets spear-phishing messages, this time offering the supposed opportunity to join a WhatsApp group.

Microsoft Cyber Defense Operations Center with several people sitting at computers

December 19, 2024
7 min read

New Microsoft guidance for the CISA Zero Trust Maturity Model

New Microsoft guidance is now available for United States government agencies and their industry partners to help implement Zero Trust strategies and meet CISA Zero Trust requirements.

Woman with glasses at a desk on a computer

December 11, 2024
14 min read

Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine

Since January 2024, Microsoft has observed Secret Blizzard using the tools or infrastructure of other threat groups to attack targets in Ukraine and download its custom backdoors Tavdig and KazuarV2.

Top-down view of a bearded man in a gray/blue shirt seated at a desk working on a Surface laptop connected to three large monitors.

December 5, 2024
4 min read

Why security leaders trust Microsoft Sentinel to modernize their SOC

Microsoft Sentinel transforms security operations centers with cloud-native SIEM capabilities, AI-powered threat detection, and cost-effective scalability to protect your entire digital ecosystem.

Microsoft Sentinel

Refine results