How Microsoft uses Windows Defender ATP–Welcome to a SecOps world! 5/27/2018 3:50 PM BRK2060 How Microsoft uses Windows Defender ATP–Welcome to a SecOps world! Brian Hooper Senior Security Analyst Microsoft | Digital Security & Risk Engineering © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | where we fit. 5/27/2018 3:50 PM DSRE Security Monitoring | where we fit. Cyber Defense Operations Center Cyber Security Services Engineering Digital Crimes Unit Digital Security & Risk Engineering Microsoft Azure (C+E Security) Microsoft Security Response Center (C+E Security) Microsoft Threat Intelligence Center (MSTIC) Office 365 Windows & Devices Group © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | how we are structured. 5/27/2018 3:50 PM DSRE Security Monitoring | how we are structured. SOC Structure SOC Data Sources TIER 1 24x7 Automated alerting (SIEM) Human alerting (User reporting) Proactive mitigation Remediation & Tracking Host Network FW++ IDS++ TIER 2 20x5 + On-call Tier 1 Escalations; L2 Analysis Automated alerting (SIEM) Windows Defender ATP Rapid Investigations Consoles TIER 3 16x5 + On-call Tier 2 Escalations; L3 Analysis Root Cause Analysis of Major Incidents Hunting, Alert Tuning, & PG Feedback Workflow Automation Operationalize the Threat SIEM Big Data (Queries & Analytics) SOC Engineering SIEM content + Ops/Maintenance (O&M) Network FW, IDS content + O&M SOC Design Monitoring Use Cases © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | why endpoint monitoring is hard. 5/27/2018 3:50 PM DSRE Security Monitoring | why endpoint monitoring is hard. Massive Scale 250K+ active users 300K+ active mailboxes 500K+ active workstations [not including mobile devices] Forward-leaning in OS > even more data per device Cloud First Highly Mobile Boundary shifts Device usage shifts BYOAnything © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | how Defender ATP helps. 5/27/2018 3:50 PM DSRE Security Monitoring | how Defender ATP helps. Management Monitoring DEPLOY AND MANAGE Built-in agent, low effort onboarding, no on-prem infrastructure CONNECTIVITY An always-on service for our always connected devices SCALE We have data from all 500K systems and it grows as we grow PRECISION Intelligent, actionable alerts fueled by Microsoft security experts SPEED Rapid host triage and deep event timeline for investigations EFFICIENCY Enables focused response and enterprise containment © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case Study 1: regsvr32.exe 5/27/2018 3:50 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) From the article: Our alert: From: https://betanews.com/2016/04/25/bypass-applocker-security/ © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) From: https://www.virustotal.com/#/domain/server1.aserdefa.ru © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) From: https://www.virustotal.com/#/file/9da91192004c51a1315773cb56c1dc6e2cef8b55e66e61d7c1c40d5b3c266cb2/detection © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) From: https://www.virustotal.com/#/file/9da91192004c51a1315773cb56c1dc6e2cef8b55e66e61d7c1c40d5b3c266cb2/detection © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 1 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 1 (cont.) XML version="1.0" <scriptlet> <registration progid="CLASS" classid=" F3011114-0000-0000-0000-4030F1ED1CDC <script language="JScript"> [CDATA[ <SNIP> wshel=new ActiveXObject(_0xd5bd('0x1b')) fso=new ActiveXObject(_0xd5bd('0x1c')) if(is_ps_installed() is_dotnet_installed()) wmi_create_process(pspath _0xd5bd('0x1d') '\x2f\x70\x31\x27\x29\x29',showexec) catch(_0x5babc9) </script> </registration> </scriptlet> From: https://www.virustotal.com/#/file/9da91192004c51a1315773cb56c1dc6e2cef8b55e66e61d7c1c40d5b3c266cb2/detection © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case Study 2: Kovter 5/27/2018 3:50 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DSRE Security Monitoring | Case Study 2 (cont.) 5/27/2018 3:50 PM DSRE Security Monitoring | Case Study 2 (cont.) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5/27/2018 3:50 PM Questions? © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session Tech Ready 15 5/27/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5/27/2018 3:50 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.