MIDNIGHT BLIZZARD: GUIDANCE FOR RESPONDERS ON NATION-STATE ATTACK

Summary from the TLDR InfoSec newsletter

Microsoft has released more information about the nation-state attack on its corporate infrastructure as well as guidance on how to respond to such attacks. The threat actor employed techniques such as password spray attacks, malicious use of OAuth applications, collection via Exchange Web Services, and the use of residential proxy infrastructure to obfuscate their activity. Microsoft also offers detection and hunting guidance for identifying similar attack tactics and techniques.