Microsoft Defender - 1

2026 (7)

September (5)

security: Reimagining the SOC for the agentic era in Microsoft Defender

Microsoft Security Blog

2026-09-23

Microsoft announced ISOC in Microsoft Defender, a foundation for agentic security that combines SIEM and threat protection capabilities in one place. The post positions this as part of reworking the SOC for agentic-era operations.

security: Improving email security outcomes with real-world Microsoft Defender insights

Microsoft Security Blog

2026-09-17

Microsoft says its latest email security benchmarking reports show strong Defender performance in both pre-delivery and post-delivery scenarios. The post also notes ongoing changes in how threats and defenses are evolving.

security: Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Security Blog

2026-09-10

Microsoft Defender is described as detecting and disrupting AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post is a Microsoft Security Blog entry dated 2026-09-10.

security: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Security Blog

2026-09-02

Microsoft Threat Intelligence reported a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. The campaign uses social engineering and legitimate tools to move from initial access to lateral movement, with Microsoft Defender used for detection and disruption.

security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Security Blog

2026-09-01

Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.

August (1)

security: 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Microsoft Security Blog

2026-08-04

Microsoft Defender isolated a compromised QNET endpoint in 128 seconds, interrupting a multi-stage ransomware attack before the payload could persist or spread.

July (1)

azure: [Launched] Generally Available: Microsoft Defender security assessments for Azure Database for PostgreSQL Flexible Server

Azure Updates

2026-07-17

Microsoft Defender CSPM assessments for Azure Database for PostgreSQL Flexible Server are now generally available. The assessments can be used to continuously evaluate the security posture of PostgreSQL flexible servers in Azure.