TrojanSpy:Win32/Keylogger

Guidance for individual users

• Do not open emails that appear suspicious or unrelated, particularly those with any links or attachments.
• Download software only from verified and legitimate sources.
• Update your device with the latest defenses.

Guidance for enterprise administrators

Apply these mitigations or workarounds to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations. 

• Run the latest version of your operating systems and applications. Turn on automatic updates or deploy the latest security updates as soon as they become available.
• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block majority of new and unknown variants. 
• Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.  
• Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.  
• Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them to Microsoft Defender for Endpoint.
• Block legacy authentication protocols in Azure Active Directory – especially Exchange Web Services (EWS)
• Enable multi-factor authentication to mitigate compromised credentials.
• For Office 365 users, see multi-factor authentication support.
• For Consumer and Personal email accounts, see how to use two-step verification.
• Use passwordless solutions like Microsoft Authenticator to secure accounts.
• Review and enforce recommended Exchange Online access policies.
• Block ActiveSync clients from bypassing Conditional Access policies.
• Block all incoming traffic from anonymizing services where possible.
• Turn on the following attack surface reduction rules to block or audit activity that can be associated with this threat. Then check the security recommendations card for the deployment status of monitored mitigations.
• Block executable files from running unless they meet a prevalence, age, or trusted list criterion
• Block credential stealing from the Windows local security authority subsystem (lsass.exe)