🧰 Microsoft Defender

The items that name it 37

• Tracking AI adoption in North Korean threat actor tradecraft
  articleas classification.technologies2026-10-29
• FastFix AI (@FastfixAI) on X
  threadas tools2026-10-18It is written here as Microsoft Defender: flagged the lookalike repo's Windows .exe as a trojan.
• Microsoft Threat Intelligence (@MsftSecIntel) on X
  advisoryas classification.technologies2026-10-17
• Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
  articleas affected products2026-10-14
• Top AI Coding Agent Security Resources — October 2026
  articleas tools2026-10-02

  Security baseline/detection tool; missed nearly half of trojanized hook-update samples

• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas classification.technologies2026-09-30
• ​​Beyond source code: A path to the keys to the kingdom
  writeupas classification.technologies2026-09-29
• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas classification.technologies2026-09-29
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeupas tools2026-09-28

  Endpoint antivirus that quarantined ISOSimple.msi in one incident (detection: Trojan:Script/Wacatac.H!ml), though it acted too late to stop persistence.

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas classification.technologies2026-09-28
• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeupas classification.technologies2026-09-25
• The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
  writeupas tools2026-09-24It is written here as Microsoft Defender: detected and removed the first two AnyDesk download attempts.
• ThreatIntel-Aggregator
  repoas classification.technologies2026-09-17
• Field Notes: From AV Alert to Impacket
  writeupas affected products2026-09-11

  generated the Behavior:Win32/RegDump.SA alert; may have interrupted the registry dump leaving a partial SAM hive

• We've got one word for it, and it's usually the wrong one
  articleas affected products2026-09-10

  Affected by the 'ShieldCrash' zero-day exploit granting SYSTEM access.

• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeupas tools2026-09-09

  Detected and flagged a command line associated with patch.msi as Trojan:Win32/Commando.A!ml, remediated but did not block execution

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas tools2026-09-03

  Endpoint protection that detected and quarantined one script (4.vbs) in the first incident; targeted for exclusion and reporting/notification disabling by attackers.

• FedRAMP 2026 vulnerability rules make reachability a requirement | Blog | Endor Labs
  articleas tools2026-08-26

  CNAPP sensor providing runtime/cloud context to resolve internet-reachability for remaining findings

• What Good Identity Hardening Looks Like
  articleas classification.technologies2026-08-25
• Critical Security Controls for Governing AI Coding Agents | Blog | Endor Labs
  articleas tools2026-07-31

  Local agent discovery that recognizes more than 35 agent types

• Socket: Operation Muck and Load
  writeupas affected products2026-07-16

  Settings modified by the payload chain as part of defense evasion.

• Defence Impairment Olympics
  writeupas affected products2026-06-29

  Antivirus/EDR product disabled and hampered via PowerShell cmdlets (Set-MpPreference) and Registry keys to prevent real-time monitoring, behavior monitoring, script scanning, and sample submission

• AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
  writeupas tools2026-06-19It is written here as Microsoft Defender (Endpoint).

  EDR/AIR to catch unexpected child process spawning (e.g., calc.exe from Python/Node parent) and post-exploitation activity

• The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
  writeupas tools2026-06-15

  Antivirus on the host; had logged unrelated detections (Trojan:Win32/Occamy.C keygen, HackTool:Win32/Netscanner, a Cryptinject sample) but did not flag the Gammadyne mailer since it is legitimate signed software

• Akira, LimeWire, and the Sour Taste of Data Exfiltration
  writeupas affected products2026-06-12

  The only default security tooling on the new VM, disabled by the threat actor within minutes of logging in

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas affected products2026-06-08

  Retained as core target in v3.

• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeupas affected products2026-06-03

  Real-time monitoring, intrusion prevention, MAPS reporting, and sample submission disabled by the loader; system drive added as exclusion path

• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas affected products2026-05-21

  Detected and blocked ransomware execution attempts (Event IDs 1116, 1117, 1118); tampered with via PowerShell exclusions and disabling

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Security tool that attackers evade via exclusions

• When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks (Semantic Kernel)
  writeupas tools2026-05-07

  Referenced for securing Copilot Studio agents and protecting agents in real-time during runtime

• 0xMohammedHassan/morphkatz
  repoas affected products2026-05-07It is written here as Microsoft Defender (mpengine.dll emulator).

  target of detection-feedback loop, signature bisection, and original reverse-engineering research into its emulator internals and heuristic scoring model

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas affected products2026-04-30

  Detected Behavior:Win32/RegDump.SA and quarantined dropped file C:\Windows\Temp\aRhRnnHI.tmp

• How a Tax Search Leads to Kernel-Mode AV/EDR Kill
  writeupas classification.key entities2026-03-19
• How the Huntress SOC Stopped a VPN-Based Ransomware Attack
  writeupas tools2026-03-13

  Endpoint security software; attacker attempted to disable it after gaining admin access

• ESXi Exploitation in the Wild
  writeupas classification.technologies2026-01-07
• Deobfuscating Files for Flags: Huntress CTF 2025 Retro
  articleas classification.technologies2025-11-06
• A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
  paperas tools

  Defense tool evaluated against HookPry-generated malicious artifacts; found to have 0% recall