Microsoft Defender Thwarts Ransomware Attack in 128 Seconds with Automatic Device Isolation In a recent incident at QNET, Microsoft Defender’s new automatic device isolation feature successfully halted a multi-stage ransomware attack in just 128 seconds, demonstrating its effectiveness against threats abusing legitimate Windows binaries. The attack began when a user opened a malicious file likely delivered via email or browser download triggering mshta.exe, a Windows Scripting Host component often exploited as a living-off-the-land binary (LOLBin). The process reached out to attacker-controlled infrastructure, retrieved a second-stage payload, and attempted persistence via RunMRU registry activity, all under normal user context. Within seconds, two Defender engines detected the threat: behavioral analysis flagged suspicious command execution and registry abuse, while the correlation engine identified the pattern as consistent with real-world attack behavior. At this stage, the attacker had gained local execution on a single endpoint but had not yet moved laterally. Microsoft’s automatic attack disruption pipeline classified the scenario as an active endpoint foothold and triggered device isolation disconnecting the compromised workstation from external and internal networks while maintaining communication with security services. This severed command-and-control channels, blocked lateral movement, and prevented data exfiltration. The isolation was time-limited and operator-controlled, allowing SOC teams to review the incident and release the device once remediated. Post-isolation, the attacker’s payload was orphaned at the network layer, unable to download additional stages or pivot to other systems. No further malicious activity such as lateral movement or outbound C2 traffic was observed. The incident highlights the importance of endpoint-level containment in ransomware defense. Traditional identity-based controls alone are insufficient when attackers gain a foothold on a device. By combining device isolation with user containment, organizations can prevent compromised endpoints from becoming launchpads for broader attacks. QNET’s case study underscores Microsoft Defender’s ability to autonomously disrupt ransomware chains before attackers escalate privileges, establish persistence, or propagate across environments. The rapid response from initial alert to isolation demonstrates how automated defenses can neutralize threats before they escalate into full-blown crises.