Matt Zorich • 2/28/2022

Detecting malware kill chains with Defender and Microsoft Sentinel

This technical article details the difference between Indicators of Compromise (IOCs) and Tactics, Techniques & Procedures (TTPs) in cybersecurity. It advocates for behavioral detection of malware kill chains using Microsoft Defender and Sentinel to identify attacks earlier, using the HermeticWiper malware as a case study for creating detections based on activity logs.

0 comments

#Ioc #Microsoft Sentinel #Microsoft Defender