Reporting an email in Microsoft Defender for Office 365

by Contributed | Oct 25, 2021 | Technology

This article is contributed. See the original author and article here.

Attackers are constantly evolving their phishing technique with sophisticated campaigns to subvert email protection systems like Microsoft Defender for Office 365 and make your security perimeters vulnerable. For this reason, it’s critical that SecOps professionals empower employees to be hypervigilant to such threats and report them as soon as they land in their inboxes.

Microsoft Defender for Office 365 has a fully automated detection and remediation system for emails, URLs and attachments that are reported by your employees. User and admin submissions are critical positive reinforcement signals for our machine learning based detection systems to review, triage, rapid-learn and mitigate attacks. The submission pipeline is a tightly integrated solution with automated mail-flow filters that protect your employees from similar threats.

You can learn here on how to report an email to Microsoft and manage your submissions here.

Once you report an email through the submission process, our system follows a set of actions. If you have any organizational compliance restrictions that prevents a user from reporting sensitive emails outside of your infrastructure, we recommend using the custom mailbox reporting option detailed here. This will ensure that user reported emails will come to your custom mailbox. Admins who are granted privileges to review those emails can then report them back to Microsoft.

Figure 1: Behind the scenes post-submission process flow.

1. Reduce the Noise: We wanted to reduce the noise from the submissions to ensure we send only clean signals for our automated triage system.
   
   
   
   1. Simulation: Your simulated messages from Attack Simulation Training or any of your 3rd party vendor will be filtered.
   
   
   2. Policy overrides: Wrongly classified messages due to your tenant’s ploicies or sometimes to end users’ policies are notified so that you can act at your end. From the override scenarios, we also honor your policies if they recommend detection improvements.
   
   
   3. Email Auth Check: We validate if the email authentication passed or failed during the email delivery.
   
   
   
   

You can learn about configuring 3^rd party simulations here and learn about our secure by default strategy here.

2. Automated Triage: We run our detection filters once again to identify if our systems have adapted between the time of delivery and your submission.
   
   
   
   1. All our machine learning based email filters will be run on your submissions to reclassify them in case of updated learning.
   
   
   2. In case of entities such as URLs and attachments in your submitted emails, we detonate them once again in our highly advanced sandbox environment to uncover the status of weaponization and assign the verdicts accordingly.
   
   
   3. We run a series of machine learning models exclusively on the reported submissions to identify, cluster the patterns and reclassify them in case of change in verdicts based on anomalies observed in similar submissions across our global customer base.
   
   
   4. We generate automated alerts on user reported phishing submissions by default and enable AIR (Automated Investigation and Response) so that these submissions will carry the verdicts from our automated triaging process. Please note that AIR is only available in MDO plan 2/E5/A5.
   
   
   
   

You can learn more about our AIR capabilities here.

3. Human Eye: As the weaponization of phishing entities are dynamic, attackers constantly use multiple evasion techniques to bypass filters. That’s why a hybrid approach and human partnered machine learning based solution is the ideal method to stay on top of advanced threats and weaponization tricks.
   
   
   
   1. We prioritize submissions based on various factors such as phish severity, malware indicators, false positives, high volume anomalies, advanced pattern indicators, and whether reported by an admin or user.
   
   
   2. Expert graders/analysts are well trained on phish detection techniques and will be dissecting submissions through various Indicators of Compromise (IOC) and do deeper investigation on all email entities such as headers, URLs, attachments, and sender reputation to assign the right verdict on submissions.
   
   
   3. Graders generally deliver informed decisions as high-quality verdict signals that are being sent to the above discussed machine learning models 2(c) for continuous reinforcement learning.
   
   
   4. Human graded verdicts always take a higher priority and can override the verdict given by the automated triage process.
   
   
   
   

Human graders review anonymized email header and body metadata and hashed entities in a highly compliant environment that meets all the privacy guidelines from our Trust Center. You can learn more about Microsoft Trust Center here. You can also learn more about data storage here, and learn more about our data retention policies here.

4. Remediation and supervised learning: The new verdict either from automated triage or human grader review will be sent for both rapid remediation and retrain our ML filters faster.
   
   
   
   1. We apply the graded labels from the automated triage system or human graders on the submitted and all related clusters belonging to this submitted pattern.
   
   
   2. We move all the messages from the current delivery location to the new location for all the impacted end users. For example, the system will move the messages from inbox to quarantine in case of ‘phish’ verdicts and move from Quarantine/Junk to inbox in case of ‘Good’ verdicts using our Zero-hour Auto Purge (ZAP) platform.
   
   
   3. We also identify IOCs by the submitted clusters and add them to our reputations to initiate instantaneous mitigation against phish and malware campaigns.
   
   
   4. Any new incoming mail from a similar pattern or IOC will be auto classified with the new verdict to reduce the triage load from your SecOps.
   
   
   
   

You can learn more about ZAP here.

The automated User Submission workflow is carefully designed with state-of-the-art technology to help the organizations to mitigate any False negative or False positive risks faster to reduce MTTR (Mean time to Response) for their SOC team. It also becomes important for organizations to enhance their security postures by training employees who actively participate in this phish detection submission feedback loop. Attack Simulation Training is included with Microsoft Defender for Office 365 P2 and E5 licenses and provides the necessary simulation and training capability that reduces phish vulnerabilities at the user-level. Learn more and get started using Attack Simulation Training here.

Do you have questions or feedback about Microsoft Defender for Office 365? Engage with the community and Microsoft experts in the Defender for Office 365 forum.

How to copy an Azure SQL Database to a different server or subscription using Azure Automation

by Contributed | Oct 24, 2021 | Technology

This article is contributed. See the original author and article here.

In this article we will demonstrate how to copy an Azure SQL DB to a different server or subscription using Azure Automation.

This article will explain the following:

1- The requirements on Azure SQL DB and how to fulfil it.

2- How to create an Azure Automation account and add a runbook to execute the copy operation.

1. Requirements for Azure SQL DB

• Use a login that has the same name and password as the database owner of the source database on the source server. The login on the target server must also be a member of the dbmanager role, or be the server administrator login.


• The below steps can be used to create the login on the source and the target server.

--Step# 1

--Create login and user in the master database of the source server.



CREATE LOGIN loginname WITH PASSWORD = 'xxxxxxxxx'

GO

CREATE USER [loginname] FOR LOGIN [loginname] WITH DEFAULT_SCHEMA=[dbo];

GO

ALTER ROLE dbmanager ADD MEMBER loginname;

GO



--Step# 2

--Create the user in the source database and grant dbowner permission to the database.



CREATE USER [loginname] FOR LOGIN [loginname] WITH DEFAULT_SCHEMA=[dbo];

GO

ALTER ROLE db_owner ADD MEMBER loginname;

GO



--Step# 3

--Capture the SID of the user "loginname" from master database



SELECT [sid] FROM sysusers WHERE [name] = 'loginname';



--Step# 4

--Connect to Destination server.

--Create login and user in the master database, same as of the source server.



CREATE LOGIN loginname WITH PASSWORD = 'xxxxxxxxx', SID = [SID of loginname login on source server];

GO

CREATE USER [loginname] FOR LOGIN [loginname] WITH DEFAULT_SCHEMA=[dbo];

GO

ALTER ROLE dbmanager ADD MEMBER loginname;

GO

From the above script we have created a same login on the source and target server that we will use on the Automation account to execute the copy.

2. Create Azure automation account and add runbook

1. Create an Automation account: From the Azure Portal go to Automation account and create a new account. If you already have an Automation account you can skip this step and use your existing Automation account instead.
   
    
   
   

    

   
   
   

    

   
   


2. Import SQLServer module: Go to the modules on your Automation account, click on modules gallery. From the search option type sqlserver and select this module. The next screen allows you to import the module.                                                                                   
   

    

   
                                                                                                                                                                   


3. Create Credential to access Azure SQL DB: Now we need to create a credential that we use to allow the automation account able to connect to the target SQL server and execute the copy operation. This credential must be the login that we created on using the above steps that have access to the source and destination servers .From the Automation account click on credential and provide a name for the credential, password and confirm the password.                                                                         
   

    

   
    
   

    

   
                                                                                                                                                              


4. Create Variables for the Azure SQL DB server name: Create a variable that we will use to connect to the target SQL server, as the copy operation should be done from the target server. The value for this variable should be the FQDN of the target server (servername.database.windows.net):                                                                                         
   

    

   
                                                                                                                                                            


5. Create the run book: Click on the runbook from the Automation account. On the create runbook screen you have to type the name for this runbook and choose PowerShell as the runbook type.                                                                                                                             
   

    

   
                                                                                                                                                              


6. When the creation is completed, click on the created runbook, click on the edit and enter the below sample code (you can use the test pane to test the runbook and click save to save it).                                                                                                                                                                                                                                                                                       

    $Cred = Get-AutomationPSCredential -Name "name_of_created_credintial"
   
    $Server_Name = Get-AutomationVariable -Name "name_of_created_variable "
    
    $Query = "CREATE DATABASE copy13 AS COPY OF [source_server_name].[source_DB_name];"
   
    invoke-sqlcmd -ServerInstance "$Server_Name"  -Credential $Cred -  Query "$Query" -Encrypt
   ​

                                                                                                                                                             



7. If you want to run this runbook on a schedule, you need to create a schedule and link this runbook to the created schedule.

How 3 makers, 2 devs and a princess came together to save kittens for a hackathon

by Contributed | Oct 23, 2021 | Technology

This article is contributed. See the original author and article here.

 

The Story (Michael)

 

The Flic and the flow (Tomasz)

 

 

 

 

Show me something beautiful – The canvas app (Carmen)

We need a real map – The custom connector to Azure Maps (Lee)

Bring me the vibes – The Spotify connector(Yannick)

The princess and the push (Luise)

What can we learn from this epic quest? (everybody)

1. Do one thing the right way, instead of a million things in a messy way

2. Take care of documentation

3. 1 + 1 = 3

4. We are all developers