As part of Azure ATP's on-going mission to provide the best protection and detection capabilities to your organization, we're thrilled to announce the record-speed release of 2 new detection alerts to GA (general availability) and one new detection to Preview status with the release of update 2.65 on Sunday.
The new Suspected NTLM relay attack Preview status alert is being released only 2 weeks after the technique was first discovered and published.
The two GA alerts focus on possible exploitation of recently discovered vulnerabilities. Remote code execution over DNS alert detects attackers attempting to run code on a domain controller over DNS protocol, while the new Suspected NTLM relay attack (Exchange account) – Preview alert detects attackers masquerading as an Exchange Sever to gain privileges in the environment. The Data exfiltration over SMB alert moved into GA status as well. This alert focuses on suspicious attempts to exfiltrate data from your domain controllers over SMB protocol.
For more information visit Azure ATP docs recent blog.
We’re always looking to ways to continually improve, and we welcome your feedback!
