Product
Microsoft Defender XDR
- First Reported
- Sep 25, 2026
- Latest Reported
- Sep 30, 2026
Reported Context (5)
- Microsoft Defender XDR advanced hunting retains 30 days of raw event data, which no longer covers the pre-disclosure reconnaissance and early exploitation described here. Attackers Exploit Zimbra CVE-2026-73570 to Compromise Internet-Facing Mail Servers
- Microsoft Defender XDR detections Phishing Campaigns Abuse MSP360 and ScreenConnect for Persistent Access
- Microsoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threat Star Blizzard Uses RedFlick Technique to Deliver CosmicPulse Malware
- Configure automatic attack disruption in Microsoft Defender XDR. Microsoft details NeedyMantis malware used in targeted post-compromise operations
- Microsoft Defender XDR detections Storm-3168 Used Compromised Azure Service Principals to Destroy Cloud Resources
CVE (1)
Malware (25)
Threat Actors (4)
MITRE ATT&CK (47)
Vendors (10)
Products (27)
Tools (3)
Industries (12)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.