Microsoft Incident Response, Author at Microsoft Security Blog

A security practitioner works at a computer.

Best practices
March 21, 2024
5 min read

How Microsoft Incident Response and Microsoft Defender for Identity work together to detect and respond to cyberthreats

Learn how Microsoft Incident Response works together with Microsoft Defender for Identity to give customers fast, flexible service—before, during, or after a cybersecurity incident occurs.

A woman sitting at a table using a laptop.

News
January 17, 2024
5 min read

New Microsoft Incident Response guides help security teams analyze suspicious activity

Access the first two cloud investigation guides from Microsoft Incident Response to improve triage and analysis of data in Microsoft 365 and Microsoft Entra ID.

A graphic showing a circuit board to represent Microsoft Incident Response.

News
December 11, 2023
4 min read

New Microsoft Incident Response team guide shares best practices for security teams and leaders

The Microsoft Incident Response team shares a downloadable, interactive, people-centric, guide to effective incident response.

A conference room with seven people around a large table. Two of the individuals are standing while the rest are seated. Several open laptops are on the table facing the individuals.

Research
December 5, 2023
28 min read

Microsoft Incident Response lessons on preventing cloud identity compromise

In real-world customer engagements, Microsoft IR sees combinations of issues and misconfigurations that could lead to attacker access to customers’ Microsoft Entra ID tenants.

Graphic showing the many arms of a cyberattack.

Best practices
December 4, 2023
3 min read

Protecting credentials against social engineering: Cyberattack Series

Our fourth installation in the Cyberattack Series examines a smishing and social engineering attack and outlines the steps organizations can take to help minimize the risk and prepare for the possibility.

Conference room or board room meeting with people sitting around table in a room with international time clocks, and a map projection.

News
October 26, 2023
4 min read

An integrated incident response solution with Microsoft and PwC

Microsoft Incident Response and PwC have announced a new global alliance to expand their joint Incident Response and Recovery capability.

a man sitting in front of a laptop computer

Research
October 25, 2023
17 min read

Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction

Microsoft has been tracking activity related to the financially motivated threat actor Octo Tempest, whose evolving campaigns represent a growing concern for many organizations across multiple industries.

Chief information security officer collaborating with practitioners in a security operations center.

Best practices
August 15, 2023
8 min read

How the Microsoft Incident Response team helps customers remediate threats

Microsoft Incident Response is a global team comprised of cybersecurity experts with deep, highly specialized knowledge in breach detection, response, and recovery.

Looking into a conference room or board room meeting including people sitting around table in a room with international time clocks.

Research
July 6, 2023
17 min read

The five-day job: A BlackByte ransomware intrusion case study

In a recent investigation by Microsoft Incident Response of a BlackByte 2.

Graphic illustrating Microsoft Incident Response.

Best practices
June 29, 2023
3 min read

Patch me if you can: Cyberattack Series

The Microsoft Incident Response team takes swift action to help contain a ransomware attack and regain positive administrative control of the customer environment.

An icon of an ID badge and shield are shown, and the shield features a tick mark. They represent an individual's credentials to keep safe to prevent cybersecurity attacks.

Best practices
April 26, 2023
3 min read

Healthy security habits to fight credential breaches: Cyberattack Series

This is the second in an ongoing series exploring some of the most notable cases of the Microsoft Incident Response Team.

IT professionals at a digital consulting firm. The firm provides custom solutions across a multitude of disciplines including IT, front and back end software development, customer support and data services.

Research
April 11, 2023
8 min read

Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign

This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.

Microsoft Incident Response posts