Office 365 will help admins find impersonation attack targets

Jill AitoroFebruary 9, 2021

Microsoft has revealed its plans to provide security and IT administrators using Defender for Office 365 with new filters that could find out which users and domains within their organizations were prone to impersonation attacks, according to BleepingComputer. Impersonation attacks take the form of email messages that closely resemble authentic users or domains to deceive targets into opening the emails. The new filters, called impersonated user and impersonated domain, enhance already existing measures in Defender for Office 365 for detecting impersonation attempts by allowing admins to specifically seek out users or domains that have been the targets of impersonation attacks. Security admins will find the new filters through the Impersonation insight pages and on a newly added Email Entity page. The new features are still works-in-progress, but Microsoft said during the reveal of its Microsoft 365 roadmap that they should be available to the public by the end of the month.

Jill Aitoro

Jill Aitoro is senior vice president of content strategy for CyberRisk Alliance. She has more than 20 years of experience editing and reporting on technology, business and policy. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media’s VARBusiness and CRN and Penton Media’s iSeries News.

Threat intelligence

Vulnerability Research (& Other “Things”) – Nico Waisman – PSW #777

March 22, 2023

We sit down with Nico Waisman to discuss vulnerability research and other security-related topics!

Threat intelligence

Chinese hackers tied to novel Linux malware

SC StaffMarch 30, 2023

Chinese hackers tied to novel Linux malware Linux servers are being targeted by the new Mlofe, which has been associated with Chinese state-sponsored advanced persistent threat operations APT41, also known as Winnti, and Earth Berberoka, also known as GamblingPuppet, The Hacker News reports.