XDR: Execution

As cyber security threats continue to evolve, malicious threat actors find more and more ways to execute malicious code on a victim’s device. Some threat actors may utilise basic scripts hidden in Office macros, whereas others take advantage of weaknesses in an application or software. A more sophisticated attacker may embed their code within trusted utilities like PowerShell to evade detection while achieving their objectives.

Initially, attackers gain access and then deploy their malicious code to initiate their operations, enabling them to deliver payloads and disrupt critical services for their benefit.

In this room, we will discuss execution attack tactics in general and how we, as security admins, can use Microsoft Defender XDR to detect and prevent them from executing malicious code on a system.

Execution tactics form the foundation of cyber threats, allowing adversaries to launch malware, establish persistence, and move laterally into their targets. Understanding how execution tactics work is the first step in defending against it.

Learning Objectives

After completing this room, you will be able to understand the following:

• What are execution attack tactics
• Discuss various attack techniques and how they can be mitigated 
• Review incidents related to an execution attack on the Microsoft Defender XDR portal
• Explain how to mitigate and respond to an execution attack using Microsoft Defender XDR