Episodes

  • The Inside Scoop on Using KQL for Cloud Data Security

    The Inside Scoop on Using KQL for Cloud Data Security
    Sep 25 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by the authors of the new book The Definitive Guide to KQL: Using Kusto Query Language for Operations, Defending, and Threat Hunting. Guests Rod Trent, Matt Zorich, and Mark Morowczynski discuss the significance of KQL (Kusto Query Language) in cloud data security and how it enables efficient data querying for threat detection in Microsoft products like Sentinel and Defender. They share insights from their own experiences, highlight key features of the book, and explain how both beginners and experts can benefit from KQL. Later in the episode Sherrod speaks with Senior Threat Hunter Lekshmi Vijayne about the growing trend of cyberattacks using malicious PowerShell commands. Lekshmi explains how attackers trick users into copying and pasting harmful code, often through compromised websites or phishing emails. They discuss how these attacks aim to install remote access tools like NetSupport RAT or information stealers, targeting sensitive data like browser credentials and crypto keys. In this episode you’ll learn: How KQL is applied in real-world security scenarios including incident response Key features and benefits of KQL when it comes to security and cloud data Distinguishing between legitimate and malicious uses of remote management tools Some questions we ask: How does KQL tie into the Microsoft ecosystem, like Defender and Copilot? What advice would you give to someone new to KQL who wants to start learning? What is the technique we're seeing with copy-pasting malicious PowerShell? Resources: View Mark Morowczynski on LinkedIn View Matt Zorich on LinkedIn View Rod Trent on LinkedIn View Lekshmi Vijayne on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    27 mins
  • Citrine and Onyx Sleet: An Inside Look at North Korean Threat Actors

    Citrine and Onyx Sleet: An Inside Look at North Korean Threat Actors
    Sep 11 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo discusses North Korean threat actors with one of our Microsoft Threat Intelligence researchers and Greg Schloemer focusing on two prominent groups: Onyx Sleet and Storm 0530. Onyx Sleet is a long-standing espionage group known for targeting defense and energy sectors, particularly in the U.S. and India. However, they’ve diversified into ransomware, using tactics like malware downloaders, zero-day vulnerabilities, and a remote access Trojan called D-Track. The conversation also touches on the use of fake certificates and the group's involvement in the software supply chain space. In this episode you’ll learn: The relationship between Onyx Sleet and Storm 0530 North Korea's broader strategy of using cyber-attacks and moonlighting activities Surprising nature of recent attack chains involving vulnerability in the Chromium engine Some questions we ask: Does Onyx Sleet engage in cryptocurrency activities as well as traditional espionage? How does the use of a fake Tableau software certificate fit into Onyx Sleet's attack chain? Where does the name "Holy Ghost" come from, and why did they choose it? Resources: View Greg Schloemer on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    29 mins
  • Black Basta and the Use of LLMs by Threat Actors

    Black Basta and the Use of LLMs by Threat Actors
    Aug 28 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Microsoft security researchers Anna Seitz and Daria Pop to discuss the latest trends in ransomware and the evolving role of AI in cyber threats. Daria Pop provides insights into the shifting tactics of Black Basta ransomware, including their use of phishing, social engineering, and remote management tools. The discussion also covers the persistence of malvertising and its challenges for defenders. Anna Seitz explores how state-sponsored threat actors, including Forest Blizzard, Emerald Sleet, and Crimson Sandstorm, are leveraging large language models (LLMs) for various malicious activities. In this episode you’ll learn: Why the takedown of Qakbot impacted Black Basta’s strategies What malvertising is and why its persistence is due to the complex nature of ad traffic How the MITRE Atlas framework assists defenders in identifying new threats Some questions we ask: What role does social engineering play in the campaigns involving Quick Assist? How are North Korean threat actors like Emerald Sleep using LLMs for their campaigns? Can you explain the changes in Black Basta’s initial access methods over the years? Resources: View Anna Seitz on LinkedIn View Daria Pop on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    24 mins
  • Disrupting Cracked Cobalt Strike

    Disrupting Cracked Cobalt Strike
    Aug 14 2024
    On this week's episode of The Microsoft Threat Intelligence Podcast, we discuss the collaborative effort between Microsoft and Fortra to combat the illegal use of cracked Cobalt Strike software, which is commonly employed in ransomware attacks. To break down the situation, our host, Sherrod DeGrippo, is joined by Richard Boscovich, Assistant General Counsel at Microsoft, Jason Lyons, Principal Investigator with the DCU, and Bob Erdman, Associate VP Research and Development at Fortra. The discussion covers the creative use of DMCA notifications tailored by geographic region to combat cybercrime globally. The group express their optimism about applying these successful techniques to other areas, such as phishing kits, and highlight ongoing efforts to make Cobalt Strike harder to abuse. In this episode you’ll learn: The impact on detection engineers due to the crackdown on cracked Cobalt Strike Extensive automation used to detect and dismantle large-scale threats How the team used the DMCA creatively to combat cybercrime Some questions we ask: Do you encounter any pushback when issuing DMCA notifications? How do you plan to proceed following the success of this operation? Can you explain the legal mechanisms behind this take-down? Resources: View Jason Lyons on LinkedIn View Bob Erdman on LinkedIn View Richard Boscovich on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    39 mins
  • Behind the Scenes at Blue Hat IL: Security Advancements and Challenges

    Behind the Scenes at Blue Hat IL: Security Advancements and Challenges
    Jul 31 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is live from Blue Hat Israel in Tel Aviv. Igal Lytzki and Din Serussi discuss their presentation on advanced phishing and evasion techniques, highlighting the rise of QR phishing and custom-made captures, which involve interactive challenges to bypass security systems. Gal Niv and Jonathan Jacobi discuss their experience with the Web3 challenge they created, focusing on a smart contract vulnerability on the Ethereum blockchain. Ida Vass, the mastermind behind BlueHat IL, talks about the conference’s impact and her motivation, driven by the community's spirit and the desire to continually innovate and Wolf Goerlich the keynote speaker, discusses his approach to the keynote, focusing on positive advancements in cybersecurity rather than dwelling on the negative. In this episode you’ll learn: Practical advice for organizations to bolster their email security defenses The critical need to apply historical attack models to new technologies Progress in hardening OS and network security and the shift in threat actor tactics Some questions we ask: What emerging technologies or threats do you find most intriguing or concerning? How does the production level of BlueHat compare to other conferences? What do state-sponsored email threats look like right now?  Resources: View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    51 mins
  • Hunting for AI Bug Bounty

    Hunting for AI Bug Bounty
    Jul 17 2024
    In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo is joined by Technical Program Manager at Microsoft Lynn Miyashita and Principal Research Manager, Andrew Paverd. They discuss the evolution of bug bounty programs into the realm of artificial intelligence, specifically focusing on Microsoft's initiative launched in October 2023. Lynn explains that the AI Bug Bounty incentivizes external security researchers to discover and report vulnerabilities in Microsoft's AI systems, such as Copilot, across various platforms including web browsers and mobile applications. Andrew elaborates on the concept of a "bug bar," which sets the criteria for vulnerabilities eligible for the program. They emphasize the importance of identifying security issues that could arise uniquely from AI systems, such as prompt injection vulnerabilities. The discussion highlights Microsoft's structured approach to handling reported vulnerabilities through their Security Response Center, emphasizing quick mitigation and coordination with researchers to ensure timely fixes and public disclosure. In this episode you’ll learn: How AI Bug Bounty programs are reshaping traditional security practices Dangers of prompt injection attacks, and their capacity to exfiltrate sensitive data Why you should engage in AI bug hunting and contribute to the evolving security landscape Some questions we ask: Which products are currently included in the Bug Bounty program? Should traditional bug bounty hunters start doing AI bug bounty hunting? How can someone get started with AI bug hunting and submitting to your program? Resources: View Lynn Miyashita on LinkedIn View Andrew Paverd on LinkedIn View Sherrod DeGrippo on LinkedIn Microsoft AI Bug Bounty Program Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    21 mins
  • Microsoft Live at the RSA Conference 2024

    Microsoft Live at the RSA Conference 2024
    Jul 3 2024
    In this episode of the Microsoft Threat Intelligence Podcast recorded at the RSA Conference in San Francisco, host Sherrod DeGrippo engages with a diverse group of cybersecurity experts. David Weston, VP of Operating System Security at Microsoft, discusses the evolution of Windows security and the role of AI. Jamie Williams from MITRE shares insights on the importance of product functionality in cybersecurity. Emma Stewart, Chief Power Grid Scientist at Idaho National Lab, talks about securing the digital transition of the power grid. Joe Slowik from MITRE emphasizes the importance of threat intelligence and integrating cybercrime entities into their attack framework. Lindsey O'Donnell, executive editor of Decipher, highlights AI's crucial role in cybersecurity and finally, Todd Pauley, deputy CISO of the Texas Education Agency, discusses the challenges faced by small school districts in Texas.  In this episode you’ll learn: How Windows security has transitioned from user-controlled to Microsoft-managed The importance of understanding product functionality to combat cyber threats Securing the power grid's digital transition and cloud technologies for grid control Some questions we ask: What challenges and opportunities arise in securing the power grid's digital transition? How does AI enhance security in Windows operating systems? What were some of the most memorable sessions you attended at RSA? Resources: View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    55 mins
  • Mark Russinovich Talks Jailbreaks

    Mark Russinovich Talks Jailbreaks
    Jun 19 2024
    On this week's episode of The Microsoft Threat Intelligence Podcast, Sherrod DeGrippo is joined by Mark Russinovich. Mark Russinovich, CTO and Technical Fellow of Microsoft Azure, joins the show to talk about his journey from developing on-prem tools like Sysinternals to working in the cloud with Azure. Sherrod and Mark discuss the evolution of cybersecurity, the role of AI in threat intelligence, and the challenge of jailbreaking AI models. Mark shares his experiences with testing AI models for vulnerabilities, including his discovery of the "Crescendo" and "Masterkey" methods to bypass safety protocols. They also touch on the issue of poisoned training data and its impact on AI reliability, while highlighting the importance of staying ahead in cybersecurity. In this episode you’ll learn: The shift from desktop computing to cloud-based systems and its implications Potential consequences of AI models having overridable safety instructions How AI training data can manipulate the outcomes generated by AI models Some questions we ask: Will AI owners be able to stop data poisoning, or will it become more common? Can you share challenges and vulnerabilities in maintaining the security of AI systems? What sparked your interest in AI jailbreaks, and what trends are you seeing? Resources: View Mark Russinovich on LinkedIn View Sherrod DeGrippo on LinkedIn AI jailbreaks: What they are and how they can be mitigated? https://www.microsoft.com/en-us/security/blog/2024/06/04/ai-jailbreaks-what-they-are-and-how-they-can-be-mitigated/ Inside AI Security with Mark Russinovich | BRK227 https://www.youtube.com/watch?v=f0MDjS9-dNw How Microsoft discovers and mitigates evolving attacks against AI guardrails. https://www.microsoft.com/en-us/security/blog/2024/04/11/how-microsoft-discovers-and-mitigates-evolving-attacks-against-ai-guardrails/ Google AI said to put glue on pizza. https://www.businessinsider.com/google-ai-glue-pizza-i-tried-it-2024-5 Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.
    Show more Show less
    32 mins