As a follow-on to the initial blog we posted about our participation in the APT29 MITRE ATT&CK evaluation, we wanted to go into more detail on the test and our results.
We are fortunate to have the opportunity to be evaluated against leading endpoint security and threat protection solutions and are very proud of the close collaboration our engineering teams have with our customers to make our product one of the best in the industry.
In the latest evaluation, customers can see our leadership and ability to fully protect them against the most sophisticated threats. During testing, Microsoft:
- Delivered automated real-time alerts without the need for configuration changes or custom detections; Microsoft is one of only three vendors who did not make configuration changes or rely on delayed detections.
- Flagged more than 80 distinct alerts, and used built-in automation to correlate these alerts into only two incidents that mirrored the two MITRE ATT&CK simulations, improving SOC analyst efficiency and reducing attacker dwell time and ability to persist.
- Identified seven distinct steps during the attack in which our protection features, which were disabled during testing, would have automatically intervened to stop the attack.
Check out the blog for the deeper dive on the evaluation and how we are collaborating with MITRE to contribute to the test: Microsoft Threat Protection leads in real-world detection in MITRE ATT&CK evaluation
Updated Jun 19, 2020
Version 1.0