Microsoft 365 to Provide Detonation Details About Malicious Email Content

iStock-1167560531In a step towards educating customers on why attachments and URLs are deemed “malicious”, Microsoft’s is set to augment its Advanced Threat Protection product in July.

There are lots of reasons why a security solution comes to a “malicious verdict” when it comes to email content. It could be the URL link in the email points to a site that’s been compromised. Or perhaps it’s that the attachment, when detonated, attempted to install software. In some cases, IT organizations never know – and can’t be better protected through experiential knowledge.

But a new update to Microsoft’s Advanced Threat Protection product will provide customers with details on any malicious behaviors the solution finds when examining and detonating email content.

According to the Microsoft 365 Roadmap entry:

We’re working to reveal more of the details that led to a malicious verdict when URLs or files are detonated in Office 365 ATP. In addition to the detonation chain (the series of detonations that were necessary to reach a verdict for this entity), we’ll also share a detonation summary, with details such as detonation time range, verdict of the file or URL, related entities (other entities called or used during the detonation), screenshots, and more.

This is a huge step in not only demonstrating the effectiveness of Microsoft’s solution, but this also allows organizations to better understand what tactics are being used and how their other security solutions can be used to protect the organization.

This spirit of educating the “why” behind malicious is what Security Awareness Training is all about; by teaching IT and users what tactics are being used, everyone’s understanding of attacks and the need for vigilance is elevated, only helping to improve the organization’s security stance.

Find out which of your users' emails are exposed before bad actors do.

Many of the email addresses and identities of your organization are exposed on the internet and easy to find for cybercriminals. With that email attack surface, they can launch social engineering, spear phishing and ransomware attacks on your organization. KnowBe4's Email Exposure Check Pro (EEC) identifies the at-risk users in your organization by crawling business social media information and now thousands of breach databases.

EECPro-1Here's how it works:

  • The first stage does deep web searches to find any publicly available organizational data
  • The second stage finds any users that have had their account information exposed in any of several thousand breaches
  • You will get a summary report PDF as well as a link to the full detailed report
  • Results in minutes!

Get Your Free Report

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews