[MMPC]Detecting credential theft through memory access modelling with Microsoft Defender ATP

[igor51]

Detecting credential theft through memory access modelling with Microsoft Defender ATP

Microsoft Defender ATP instruments memory-related function calls such as VirtualAlloc and VirtualProtect to catch in-memory attack techniques like reflective DLL loading. The same signals can also be used to generically detect malicious credential dumping activities performed by a wide range of different individual tools.

The post Detecting credential theft through memory access modelling with Microsoft Defender ATP appeared first on Microsoft Security.

Source: Detecting credential theft through memory access modelling with Microsoft Defender ATP