[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"vendor:microsoft":3},{"vendor":4,"products":15,"links":124,"research":146,"news":199,"iocs":252,"iocs_total":351,"activity":352},{"slug":5,"name":6,"domain":7,"website_url":8,"hq_country":9,"description":10,"logo_path":11,"brand_color":12,"pitch":13,"pitch_source_url":8,"updated_at":14},"microsoft","Microsoft","microsoft.com","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity","US","Maker of Windows and Microsoft 365, and a large security vendor in its own right, covering identity, endpoint, email, cloud and SIEM.","\u002Fvendor-logos\u002Fmicrosoft.png","#0078d4","Defend your data from cyberattacks using cloud data security solutions. Safeguard your infrastructure, apps, and data with Microsoft Security solutions.","2026-10-16T13:44:13.137304+00:00",[16,31,42,53,64,75,86,97,112],{"slug":17,"name":18,"url":19,"description":20,"pitch":21,"pitch_source_url":19,"controls":22},"entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.","Strengthen identity security with Microsoft Entra ID, a cloud identity and access (IAM) solution that prevents identity attacks and supports SSO and Zero Trust.",[23,27],{"slug":24,"name":25,"problem":26},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":28,"name":29,"problem":30},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":32,"name":33,"url":34,"description":35,"pitch":36,"pitch_source_url":34,"controls":37},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.","Strengthen endpoint protection with Microsoft Defender for Endpoint. Stop cyberattacks, boost endpoint security with AI, and secure your devices.",[38],{"slug":39,"name":40,"problem":41},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":43,"name":44,"url":45,"description":46,"pitch":47,"pitch_source_url":45,"controls":48},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.","Protect your organization's identity fabric with Microsoft Defender for Identity, an advanced cybersecurity platform for identity threat detection and response.",[49],{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"url":56,"description":57,"pitch":58,"pitch_source_url":56,"controls":59},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.","Microsoft Defender for Office 365 protects your email and collaboration tools from phishing, malware, and BEC attacks using AI-powered, enterprise-grade threat defense.",[60],{"slug":61,"name":62,"problem":63},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":65,"name":66,"url":67,"description":68,"pitch":69,"pitch_source_url":67,"controls":70},"sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.","Run a faster, leaner SOC with Microsoft Sentinel, a cloud-native SIEM that detects threats faster, automates response, and lowers SIEM costs with a data lake.",[71],{"slug":72,"name":73,"problem":74},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":76,"name":77,"url":78,"description":79,"pitch":80,"pitch_source_url":78,"controls":81},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.","Safeguard business-critical data with Microsoft Purview. Discover unified data security, information protection, data loss prevention, and insider risk management.",[82],{"slug":83,"name":84,"problem":85},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":87,"name":88,"url":89,"description":90,"pitch":91,"pitch_source_url":89,"controls":92},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.","Explore Microsoft Defender for Cloud, a security solution and CNAPP that protects cloud‑native application development across multicloud and hybrid environments.",[93],{"slug":94,"name":95,"problem":96},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":98,"name":99,"url":100,"description":101,"pitch":102,"pitch_source_url":100,"controls":103},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.","Microsoft Intune is a cloud-based unified endpoint management solution built on Zero Trust. Empower IT to manage, secure and govern devices, apps and endpoints.",[104,108],{"slug":105,"name":106,"problem":107},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":109,"name":110,"problem":111},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":113,"name":114,"url":115,"description":116,"pitch":117,"pitch_source_url":118,"controls":119},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.","Application Control restricts which applications users are allowed to run and the code that runs in the system core.","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002Fappcontrol",[120],{"slug":121,"name":122,"problem":123},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[125,129,133,137,140,143],{"kind":126,"label":127,"url":128},"advisories","Security Update Guide (MSRC)","https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide",{"kind":130,"label":131,"url":132},"research","Microsoft Threat Intelligence blog","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Ftopic\u002Fthreat-intelligence\u002F",{"kind":134,"label":135,"url":136},"review","AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"kind":134,"label":138,"url":139},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"kind":134,"label":141,"url":142},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",{"kind":134,"label":144,"url":145},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",{"total":147,"stories":148},317,[149,154,159,164,169,174,179,184,189,194],{"slug":150,"title":151,"published_at":152,"brief":153},"sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2","SCKit abuses ScreenConnect to deploy remote access and target technician sessions","2026-11-13T21:31:44+00:00","SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.",{"slug":155,"title":156,"published_at":157,"brief":158},"artex-attackers-adopted-this-ai-pentesting-tool-in-three-months-leaked-secrets-a-8d732f","ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.","2026-11-13T15:22:30+00:00","Attackers are using the AI pentesting tool ARTEX, with leaked secrets providing the fastest entry.",{"slug":160,"title":161,"published_at":162,"brief":163},"trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents-f426b0","Trained to betray: How post-training supply chain attacks hijack coding agents","2026-11-12T17:00:00+00:00","Post-training supply chain attacks can hijack AI coding agents via poisoned datasets or model checkpoints.",{"slug":165,"title":166,"published_at":167,"brief":168},"microsoft-recent-windows-updates-cause-sql-server-performance-issues-52b2d8","Microsoft: Recent Windows updates cause SQL Server performance issues","2026-11-12T12:11:11+00:00","Microsoft confirms Windows updates since Oct 2026 cause SQL Server performance issues.",{"slug":170,"title":171,"published_at":172,"brief":173},"microsoft-warns-hackers-are-using-gsocket-backdoors-to-keep-linux-servers-compro-d79655","Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching","2026-11-12T09:44:00+00:00","Hackers use GSocket backdoor to maintain Linux server access post-patching.",{"slug":175,"title":176,"published_at":177,"brief":178},"hackers-plant-gsocket-on-linux-servers-for-persistent-access-5af37a","Hackers plant GSocket on Linux servers for persistent access","2026-11-12T09:38:00+00:00","Hackers are using GSocket, a legitimate remote access tool, to maintain persistent access on Linux servers.",{"slug":180,"title":181,"published_at":182,"brief":183},"net-11-security-changes-target-the-software-supply-chain-814bb2",".NET 11 security changes target the software supply chain","2026-11-12T08:23:33+00:00",".NET 11 security updates include supply chain controls, authentication improvements, and crash reporting.",{"slug":185,"title":186,"published_at":187,"brief":188},"microsoft-discovers-59-linux-kernel-security-bugs-using-ai-including-flaws-hidde-4ec823","Microsoft Discovers 59 Linux Kernel Security Bugs Using AI, Including Flaws Hidden for Over 20 Years","2026-11-12T07:24:12+00:00","Microsoft AI finds 59 Linux kernel bugs, some over 20 years old, with 8 confirmed exploits.",{"slug":190,"title":191,"published_at":192,"brief":193},"the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2-f3f53e","The global socket: how threat actors are weaponizing GSocket for stealthy C2","2026-11-11T19:49:57+00:00","Threat actors are using GSocket on Linux servers to maintain access after vulnerabilities are patched.",{"slug":195,"title":196,"published_at":197,"brief":198},"lessons-from-59-linux-kernel-bug-reports-37d277","Lessons from 59 Linux Kernel Bug Reports","2026-11-11T16:55:00+00:00","Microsoft FORGE Lab researchers found 59 Linux kernel bugs, 33 CVEs, and 8 privilege-escalation exploits.",{"total":200,"stories":201},783,[202,207,212,217,222,227,232,237,242,247],{"slug":203,"title":204,"published_at":205,"brief":206},"microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92","Microsoft 365 Crawls Back to Life After a 24-Hour Outage","2026-11-13T19:08:57+00:00","Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.",{"slug":208,"title":209,"published_at":210,"brief":211},"the-microsoft-outage-is-a-warning-for-the-world-aa3046","The Microsoft Outage Is a Warning for the World","2026-11-13T17:15:54+00:00","Microsoft 365 outage impacts Outlook, Teams, and Copilot globally for a second day.",{"slug":213,"title":214,"published_at":215,"brief":216},"november-patch-tuesday-how-to-sort-through-the-patches-dacc34","November Patch Tuesday: How to Sort Through the Patches","2026-11-13T15:23:43+00:00","Microsoft's November Patch Tuesday addresses 1,252 CVEs, highlighting the need for strategic patching over a blanket",{"slug":218,"title":219,"published_at":220,"brief":221},"hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91","Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware","2026-11-13T14:54:56+00:00","Hackers exploit weak passwords to compromise Microsoft SQL Servers, deploying malware for crypto mining and remote",{"slug":223,"title":224,"published_at":225,"brief":226},"hackers-use-fake-purchase-order-emails-to-deliver-xloader-malware-through-malici-fb620b","Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents","2026-11-13T14:09:51+00:00","Hackers distribute XLoader malware via fake purchase order Word documents exploiting CVE-2017-11882.",{"slug":228,"title":229,"published_at":230,"brief":231},"microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956","Microsoft Struggles to Restore Email and Other Services in a Global Outage","2026-11-13T13:47:42+00:00","Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.",{"slug":233,"title":234,"published_at":235,"brief":236},"ncsc-cert-se-veckobrev-v-46-8d4dec","NCSC – CERT-SE veckobrev v.46","2026-11-13T10:00:00+00:00","Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.",{"slug":238,"title":239,"published_at":240,"brief":241},"microsoft-confirms-windows-activation-failures-after-november-updates-9c5c30","Microsoft confirms Windows activation failures after November updates","2026-11-13T09:36:18+00:00","Microsoft confirms Windows activation failures after November updates.",{"slug":243,"title":244,"published_at":245,"brief":246},"new-signdrop-exploit-can-abuse-windows-defender-to-bypass-security-protections-e80015","New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections","2026-11-13T09:02:00+00:00","New Windows zero-day 'SignDrop' allows local attackers to gain SYSTEM privileges by abusing CLFS.",{"slug":248,"title":249,"published_at":250,"brief":251},"nightmare-eclipse-drops-windows-zero-day-exploit-signdrop-d89589","Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’","2026-11-13T08:50:36+00:00","Nightmare Eclipse drops Windows zero-day exploit 'SignDrop' abusing CLFS and Windows Defender.",[253,256,258,260,262,265,267,269,273,275,279,284,286,291,295,299,304,309,314,316,319,321,323,327,331,336,337,342,344,349],{"type":254,"value":255,"article_slug":213,"article_title":214,"published_at":215},"cve","CVE-2026-118146",{"type":254,"value":257,"article_slug":213,"article_title":214,"published_at":215},"CVE-2026-118207",{"type":254,"value":259,"article_slug":213,"article_title":214,"published_at":215},"CVE-2026-124194",{"type":254,"value":261,"article_slug":223,"article_title":224,"published_at":225},"CVE-2017-11882",{"type":263,"value":264,"article_slug":223,"article_title":224,"published_at":225},"malware","XLoader",{"type":263,"value":266,"article_slug":233,"article_title":234,"published_at":235},"WhiteArmor",{"type":263,"value":268,"article_slug":248,"article_title":249,"published_at":250},"SignDrop",{"type":254,"value":259,"article_slug":270,"article_title":271,"published_at":272},"never-be-afraid-to-ask-questions-3e6401","Never be afraid to ask questions","2026-11-12T19:00:00+00:00",{"type":254,"value":274,"article_slug":270,"article_title":271,"published_at":272},"CVE-2026-125350",{"type":263,"value":268,"article_slug":276,"article_title":277,"published_at":278},"new-signdrop-zero-day-exploit-turns-windows-clfs-security-feature-into-system-ac-c892fb","New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access","2026-11-12T17:50:27+00:00",{"type":263,"value":280,"article_slug":281,"article_title":282,"published_at":283},"Gh0st RAT","hackers-abuse-microsoft-sql-servers-to-deploy-monero-miner-and-gh0st-rat-20a0e5","Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT","2026-11-12T16:30:49+00:00",{"type":263,"value":285,"article_slug":281,"article_title":282,"published_at":283},"Monero miner",{"type":263,"value":287,"article_slug":288,"article_title":289,"published_at":290},"Play ransomware","your-endpoint-management-platform-could-be-your-biggest-security-risk-61d140","Your Endpoint Management Platform Could Be Your Biggest Security Risk","2026-11-12T15:00:10+00:00",{"type":254,"value":257,"article_slug":292,"article_title":293,"published_at":294},"microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era-322862","Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era","2026-11-12T14:55:00+00:00",{"type":254,"value":259,"article_slug":296,"article_title":297,"published_at":298},"cisa-confirms-active-exploitation-of-outlook-user-interaction-0-day-vulnerabilit-204fc2","CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability","2026-11-12T14:11:54+00:00",{"type":263,"value":300,"article_slug":301,"article_title":302,"published_at":303},"Cereal","romania-says-it-stopped-russian-cyberattack-targeting-government-emails-96ca28","Romania says it stopped Russian cyberattack targeting government emails","2026-11-12T13:30:00+00:00",{"type":263,"value":305,"article_slug":306,"article_title":307,"published_at":308},"AntiFox","hackers-abuse-antifox-ai-pentesting-tool-to-deploy-webshells-and-access-aws-prod-858104","Hackers Abuse AntiFox AI Pentesting Tool to Deploy Webshells and Access AWS Production Secrets","2026-11-12T11:42:54+00:00",{"type":254,"value":310,"article_slug":311,"article_title":312,"published_at":313},"CVE-2020-1337","hackers-abuse-windows-group-policy-to-deploy-citrus-ransomware-and-disable-micro-c82f42","Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender","2026-11-12T06:46:42+00:00",{"type":254,"value":315,"article_slug":311,"article_title":312,"published_at":313},"CVE-2026-54121",{"type":317,"value":318,"article_slug":311,"article_title":312,"published_at":313},"domain","mirror.yandex.ru",{"type":317,"value":320,"article_slug":311,"article_title":312,"published_at":313},"yastatic.net",{"type":263,"value":322,"article_slug":311,"article_title":312,"published_at":313},"Sn00py",{"type":263,"value":305,"article_slug":324,"article_title":325,"published_at":326},"ai-pentest-tool-antifox-abused-to-steal-aws-credentials-236b27","AI Pentest Tool AntiFox Abused To Steal AWS Credentials","2026-11-11T21:31:32+00:00",{"type":263,"value":268,"article_slug":328,"article_title":329,"published_at":330},"signdrop-windows-clfs-zero-day-gives-system-access-0ce4b0","SignDrop Windows CLFS Zero-Day Gives SYSTEM Access","2026-11-11T16:40:06+00:00",{"type":254,"value":332,"article_slug":333,"article_title":334,"published_at":335},"CVE-2025-29824","windows-signdrop-0-day-exploit-lets-attackers-gain-system-privileges-through-clf-88f6de","Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection","2026-11-11T13:57:20+00:00",{"type":263,"value":268,"article_slug":333,"article_title":334,"published_at":335},{"type":254,"value":338,"article_slug":339,"article_title":340,"published_at":341},"CVE-2026-119832","windows-bitlocker-vulnerabilities-allow-attackers-to-bypass-security-feature-dcf611","Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature","2026-11-11T11:31:29+00:00",{"type":254,"value":343,"article_slug":339,"article_title":340,"published_at":341},"CVE-2026-97015",{"type":254,"value":345,"article_slug":346,"article_title":347,"published_at":348},"CVE-2026-119390","multiple-windows-remote-desktop-flaws-allow-attackers-to-execute-code-over-netwo-aa67c9","Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network","2026-11-11T11:22:00+00:00",{"type":254,"value":350,"article_slug":346,"article_title":347,"published_at":348},"CVE-2026-119858",1854,[353,357,361,365,369,372],{"month":354,"reported":355,"affected":356},"2026-06-01",40,94,{"month":358,"reported":359,"affected":360},"2026-07-01",31,96,{"month":362,"reported":363,"affected":364},"2026-08-01",32,82,{"month":366,"reported":367,"affected":368},"2026-09-01",46,89,{"month":370,"reported":355,"affected":371},"2026-10-01",92,{"month":373,"reported":374,"affected":375},"2026-11-01",30,86]