Will Advanced Threat Analytics help me with all operating systems?

Short answer is yes, but there is a qualifier.  The activity still needs to hit Active Directory (AD), whether by connecting to the network via AD, querying the DNS servers, or authenticating with AD.  All that activity is inspected for anomalous activities, regardless of the operating system.

 https://blogs.technet.microsoft.com/enterprisemobility/2016/12/12/will-advanced-threat-analytics-help-me-with-non-windows-oss/

Comments

Post a Comment

Popular posts from this blog

Cyber Security Attackers Toolkit – What You Need to Know

For the security-interested, a more technical look at the tools attackers use during a cyber attack and how Advanced Threat Analytics plays a role in detecting these attacks and provides a higher level of visibility into them. https://blogs.technet.microsoft.com/enterprisemobility/2017/01/24/cyber-security-attackers-toolkit-what-you-need-to-know/
Read more

Microsoft Customer Guidance for WannaCrypt Attacks

As you no doubt are aware, the WannaCrypt attacks over the last couple of weeks have been quite pervasive. Microsoft has provided some guidance on the WannaCrypt attacks that I thought you should be aware of, both for Azure as well as on-premises. https://azure.microsoft.com/en-us/blog/wannacrypt-attacks-guidance-for-azure-customers/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ Of note, Microsoft has released security patches for OS versions that are no longer in mainstream support, i.e. Windows XP, Windows 8 and Windows Server 2003.
Read more

Eliminating Plaintext Passwords With Microsoft Advanced Threat Analytics Using LDAP

Happy New Year to everyone! To start off 2017 on an easy note, have a look at this article regarding the use of Microsoft Advanced Threat Analytics (ATA) to identify those applications and services that may still be sending passwords in plaintext in your network environment.  This is typically the result of simple LDAP binds being used for authentication purposes, which exposes your environment to attacks focused on privilege escalation. https://blogs.technet.microsoft.com/enterprisemobility/2017/01/09/eliminating-plaintext-passwords-with-microsoft-advanced-threat-analytics-using-ldap/
Read more