Security News > 2022 > July > Microsoft adds default protection against RDP brute-force attacks
"Win11 builds now have a DEFAULT account lockout policy to mitigate RDP and other brute force password vectors," David Weston of Enterprise and OS Security at Microsoft, announced, just as the company confirmed that it will resume the rollout of the default blocking of VBA macros obtained from the internet.
Brute-forced RDP access and malicious macros have for a long time been two of the most popular tactics used by threat actors to gain unauthorized access to Windows systems.
The Windows Account Lockout Policy allows enterprise network admins to set a lockout threshold - a specific number of failed logon attempts - after which a user account will be locked.
The default blocking of VBA macros rollout continues.
In February 2022, Microsoft announced the default blocking of VBA macros obtained from the internet for five Office apps that run macros.
"If you ever enabled or disabled the Block macros from running in Office files from the Internet policy, your organization will not be affected by this change," she added.
News URL
https://www.helpnetsecurity.com/2022/07/21/microsoft-protection-rdp-brute-force-attacks/
Related news
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Microsoft fixes under-attack privilege-escalation holes in Hyper-V (source)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- Week in review: 48k Fortinet firewalls open to attack, attackers “vishing” orgs via Microsoft Teams (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)
- CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Microsoft Identifies 3,000 Leaked ASP.NET Keys Enabling Code Injection Attacks (source)
- Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries (source)
- Microsoft: Hackers steal emails in device code phishing attacks (source)