VMRay Connector to Microsoft Defender for Office
by VMRay GmbH
Understand the threat - Enrich alerts&indicators - Clear verdict and IOCs in Defender
VMRay Connector for Microsoft Defender for Office
Enhance your protection against phishing threat by:
- Gaining a clear understanding of the threats you face
- Protecting against active threats in real time
- Streamlining triage of Microsoft Defender for Office (MDO) alerts
- Accelerating incident response and investigation
Offer Description
The VMRay Connector for Microsoft Defender for Office (MDO) continuously monitors Defender alerts to extract and analyze URLs found in alert evidence or via the Graph API.
VMRay performs recursive dynamic analysis of each URL to reveal attacker intent and uncover all stages of the attack chain. By simulating real user behavior, VMRay’s auto-UI technology can expose phishing attempts, credential harvesting, or malware delivery activities.
All Defender alerts are automatically enriched with the results of VMRay’s analysis, including:
- VMRay verdict (malicious, suspicious, clean)
- Threat classification and name
- VMRay Threat Indicators (VTIs) providing a quick overview of malicious or suspicious behaviors of the malware
Malicious and suspicious Indicators of Compromise (IOCs) uncovered by VMRay are automatically added to Defender indicators. This enables proactive blocking of similar threats—preventing future infection attempts before they reach your network.
When deeper investigation is required, Incident Responders can access the complete analysis directly in the VMRay Console. Detailed artifacts such as MITRE ATT&CK mapping, PCAP files, memory dumps, process trees, and extracted malware configurations provide comprehensive visibility into the threat’s behavior at the time of the attack.
Who Benefits from this Integration
SOC Analysts:
Gain immediate, actionable insight into each threat. Analysts can quickly
triage alerts within the Defender console using enriched data from VMRay,
helping them prioritize and respond efficiently without manual IOC creation.
Incident Responders:
Start investigations with a full understanding of how the threat operated
during the attack. For instance, if a user-reported email contained a malicious
URL that is no longer active, responders can still access the full malware
sample, IOCs, and TTPs from VMRay to accelerate threat hunting and containment.
Cyber Threat Intelligence (CTI) Teams:
Receive real-time IOCs extracted from active threats. These indicators can be
automatically shared with Microsoft Sentinel or Threat Intelligence Platforms
(TIPs). Cross-referencing these IOCs with other intelligence sources can help
identify the threat actor behind the campaign.
Key Benefits and Pain Points Addressed
- Prioritize critical threats by understanding attacker intent and allocating resources effectively
- Empower resource-constrained SOCs with enriched Defender alerts that simplify triage and reduce manual effort
- Block persistent attackers who rotate URLs or payloads to evade detection and deliver zero-day malware
- Uncover elusive, short-lived attacks that would otherwise go undetected