Incident response

Incident response is the process of detecting, investigating, and responding to cyberattacks, security breaches, or IT incidents. Explore the latest trends and intelligence-driven strategies that help you prevent future attacks.

Refine Results

Filtered by

Clear All

Incident response

Refine results

Sort By

Content Type

Topic

Products and services

Publish date

Start Date

End Date

January 7

3 min read

Explore the latest Microsoft Incident Response proactive services for enhanced resilience

The new proactive services from Microsoft Incident Response turn security uncertainty into readiness with expert‑led preparation and advanced intelligence.
January 6

4 min read

Introducing the Microsoft Defender Experts Suite: Elevate your security with expert-led services

Announcing Microsoft Defender Experts Suite, a integrated set of expert-led services that helps security teams keep pace with modern cyberattacks.
December 11, 2025

3 min read

Imposter for hire: How fake people can gain very real access

Fake employees are an emerging cybersecurity threat.
November 3, 2025

10 min read

SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

Microsoft Incident Response – Detection and Response Team (DART) researchers uncovered a new backdoor that is notable for its novel use of the OpenAI Assistants Application Programming Interface (API) as a mechanism for command-and-control (C2) communications.
Retain Microsoft Security Experts
Microsoft Security Experts are now available to strengthen your team with managed security services. Learn how to defend against threats with security experts.
Get started
September 24, 2025

4 min read

Retail at risk: How one alert uncovered a persistent cyberthreat

In the latest edition of our Cyberattack Series, we dive into real-world cases targeting retail organizations.
August 5, 2025

4 min read

Elevate your protection with expanded Microsoft Defender Experts coverage

Defender Experts now offers 24/7, expert-driven protection for cloud workloads, beginning with hybrid and multicloud servers in Microsoft Defender for Cloud.
March 17, 2025

13 min read

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

Microsoft Incident Response uncovered a novel remote access trojan (RAT) named StilachiRAT, which demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.
February 10, 2025

4 min read

Build a stronger security strategy with proactive and reactive incident response: Cyberattack Series

Find out how a cyberattack by Storm-2077 was halted faster because the Microsoft Incident Response team is both proactive and reactive at the same time.
Secure and verify every identity with Microsoft Entra
Microsoft Entra expands beyond identity and access management with new product categories such as cloud infrastructure entitlement management (CIEM) and decentralized identity.
Learn more
August 28, 2024

7 min read

The art and science behind Microsoft threat hunting: Part 3

In this blog post, read how Microsoft Incident Response leverages three types of threat intelligence to enhance incident response scenarios.
July 27, 2024

16 min read

Windows Security best practices for integrating and managing security tools

We examine the recent CrowdStrike outage and provide a technical overview of the root cause.
June 25, 2024

7 min read

How to boost your incident response readiness

Discover key steps to bolster incident response readiness, from disaster recovery plans to secure deployments, guided by insights from the Microsoft Incident Response team.
June 12, 2024

5 min read

Microsoft Incident Response tips for managing a mass password reset

When an active incident leaves systems vulnerable, a mass password reset may be the right tool to restore security.

Incident response

Filtered by

Refine results

Retain Microsoft Security Experts

Secure and verify every identity with Microsoft Entra

Get started with Microsoft Security