Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Investigate and respond to incidents in Microsoft Defender

4 September 2026Doc update+51 / −51 lines

In brief

The article title, headings, descriptions, and deployment references were updated from Microsoft Defender XDR to Microsoft Defender. Threat intelligence wording and tutorial links were also revised, along with metadata and the publication date.

What Defender admins need to know

Administrators following this guidance should use the updated terminology and tutorial links. No administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Investigate and respond using Microsoft Defender XDR

This article outlines the process to create incidents with attack simulations and tutorials and use Microsoft Defender XDR to investigate and respond. Before starting this process, be sure you've reviewed the overall process for piloting and deploying Microsoft Defender and you have at least piloted some of the components of Microsoft Defender XDR.Defender.

An incident in Microsoft Defender XDR is a collection of correlated alerts and associated data that make up the story of an attack. Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant.

End-to-end deployment for Microsoft Defender XDR

This is article 6 of 6 in a series to help you deploy the components of Microsoft Defender XDR, including investigating and responding to incidents.

Phase Link
A. Start the pilot Start the pilot
B. Pilot and deploy Microsoft Defender XDR components - Pilot and deploy Defender for Identity

- Pilot and deploy Defender for Office 365

- Pilot and deploy Defender for Endpoint

- Pilot and deploy Microsoft Defender for Cloud Apps
C. Investigate and respond to threats Practice incident investigation and response (this article)

At any time during your pilot and deployment, you can test Microsoft Defender XDR's incident response and automated investigation and remediation capabilities by creating an incident with a simulated attack and using the Microsoft Defender portal to investigate and respond.

Workflow for incident investigation and response using Microsoft Defender XDR

Here's the workflow for investigating and responding to incidents using Microsoft Defender XDR in your production environment.

Step 1. Gather threat intelligence to identify adversaries and their infrastructure

Microsoft Defender Threat Intelligence (Defender TI)in Microsoft Defender XDR provides threat intelligence information such as specific indicators of compromise (IOCs), threat research, and research and analyses straightanalysis from Microsoft experts and other sources. You can review threat intelligence articles or search for threat actors, vulnerabilities, and other indicators to support your investigations. You can read articles or search for threat actors, vulnerabilities, and other IOCs to gain insight on the types of threats that you might want to investigate.

For more information, see What is Microsoft Defender Threat Intelligence (Defender TI)?Microsoft Threat Intelligence in Microsoft Defender XDR

Step 2. Simulate attacks with the Microsoft Defender portal

  1. Create a simulation

    For step by step-by-step instructions on how to create and launch a new simulation, see Simulate a phishing attack.

  2. Create a payload

    For step by step-by-step instructions on how to create a payload for use within a simulation, see Create a custom payload for attack simulation training.

  3. Gaining insights

    For step by step-by-step instructions on how to gain insights with reporting, see Gain insights through attack simulation training.

    [!VIDEO https://learn-video.azurefd.net/vod/player?id=37f13948-e44b-4d1a-ac3b-a13ce02dabec]

First, you need to add an isolated AD DS domain controller and a Windows device to your pilot environment.

  1. Verify your pilot environment tenant has enabled Microsoft Defender.

  2. Verify that your domain controller:

One alternative is to host your AD DS domain controller and test device as virtual machines in Microsoft Azure infrastructure services. You can use the instructions in Phase 1 of the simulated enterprise Test Lab Guide, but skip the creation of the APP1 virtual machine.

Here'sThe following diagram shows the result.completed pilot environment.

:::image type="content" source="media/pilot-deploy-investigate-respond/eval-defender-eval-investigate-respond-endpoints-tlg.png" alt-text="A diagram of the evaluation environment using the simulated enterprise Test Lab Guide." lightbox="media/pilot-deploy-investigate-respond/eval-defender-eval-investigate-respond-endpoints-tlg.png":::

You'll simulate a sophisticatedan advanced attack that leverages advanceduses stealth techniques to hide from detection. The attack enumerates openedlists open Server Message Block (SMB) sessions on domain controllers andcontrollers. It also retrieves recent IP addresses of users' devices. This category ofFileless in-memory attacks usually doesnlike this one don't includedrop files dropped on the victim's device anddevice. Instead, they occur solelyrun only in memory. They "live off the land" by using existingbuilt-in system and administrative tools andadmin tools. They also inject their code into system processes to hide their execution. Suchwhat they're doing. This behavior allowshelps them to evade detection and persist on the device.

In this simulation, our samplethe scenario starts with a PowerShell script. In the real world, a user might be tricked into running a script or thescript. The script might also run from a remote connection to another computer from a previously infected device, which indicates thatdevice. This behavior suggests the attacker is attemptingtrying to move laterally in the network. Detection of theseThese scripts can be difficultare hard to detect because administratorsadmins also often run scripts remotely to carry out various administrative activities.for routine tasks.

:::image type="content" source="media/pilot-deploy-investigate-respond/mtpdiydiagram.png" alt-text="A screenshot of the Fileless PowerShell attack with process injection and SMB reconnaissance attack." lightbox="media/pilot-deploy-investigate-respond/mtpdiydiagram.png":::

During the simulation, the attack injects shellcode into a seemingly innocent process. The scenario requires the use of notepad.exe. We chose this process for the simulation, but attackers would more likely target a long-running system process, such as svchost.exe. The shellcode then goes on to contact the attacker's command-and-control (C2) server to receive instructions on how to proceed. The script attempts executing reconnaissance queries against the domain controller (DC). Reconnaissance allows an attacker to get information about recent user login information. Once attackers have this information, they can move laterally in the network to get to a specific sensitive accountaccount.

The simulated attack code will attempt to communicate to an external IP address (simulating the C2 server) and then attempt reconnaissance against the domain controller through SMB.

The following console output confirms that the simulated reconnaissance action completed successfully against the domain controller: 

ran NetSessionEnum against [DC Name] with return code result 0

To see the Automated Incident and Response feature in action, keep the notepad.exe process open. You'll see Automated Incident and Response stop the Notepad process.

Investigate the incident for the simulated attack

Investigate the attack as a single incident

Microsoft Defender correlates analytics and aggregates all related alerts and investigations from different products into one incident entity. By doing so, Microsoft Defender shows a broader attack story, allowing the SOC analyst to understand and respond to complex threats.

The alerts generated during this simulation are associated with the same threat, and as a result, are automatically aggregated as a single incident.

  1. From the navigation pane, select Incidents & Alerts > Incidents.

  2. Select the newest item by selecting the circle to the left of the incident name. A side panel displays additional information about the incident, including all the related alerts. Each incident has a unique name that describes it based on the attributes of the alerts it includes.

    The alerts that are shown in the dashboard can be filtered based on service resources: Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, Microsoft Defender XDR, and Microsoft Defender for Office 365.

Let's look at some of the alerts generated during the simulated attack.

:::image type="content" source="media/pilot-deploy-investigate-respond/fig6.png" alt-text="A screenshot of an example of a generated alert." lightbox="media/pilot-deploy-investigate-respond/fig6.png":::

We employ large-scale learning algorithms to establish the normal behavior of common processes within an organization and worldwide and watch for when these processes show anomalous behaviors. These anomalous behaviors often indicate that extraneous code was introduced and is running in an otherwise trusted process.

For this scenario, the process notepad.exe is exhibiting abnormal behavior, involving communication with an external location. The detection of this abnormal external communication is independent of the specific method used to introduce and execute the malicious code.

Alert: User and IP address reconnaissance (SMB) (Source: Microsoft Defender for Identity)

Enumeration using Server Message Block (SMB) protocol enables attackers to get recent user sign-in information that helps them move laterally through the network to access a specific sensitive account.

In this detection, an alert is triggered when the SMB session enumeration runs against a domain controller.

[!VIDEO https://learn-video.azurefd.net/vod/player?id=340dee63-452a-4d4b-9ca3-562206a4bc23]

Navigate back to the incident in the Microsoft Defender portal. The Investigations tab in the Incident page shows the automated investigations that were triggered by Microsoft Defender for Identity and Microsoft Defender for Endpoint. In this example,the following screenshot, only the automated investigation triggered by Defender for Endpoint is displayed. By default, Defender for Endpoint automatically remediates the artifacts found in the queue, which requires remediation.

:::image type="content" source="media/pilot-deploy-investigate-respond/fig14.png" alt-text="A screenshot of an example of the automated investigations related to the incident." lightbox="media/pilot-deploy-investigate-respond/fig14.png":::

:::image type="content" source="media/incidents-ss-incidents.png" alt-text="A screenshot of the Incidents & alerts section in the Microsoft Defender portal." lightbox="media/incidents-ss-incidents.png":::

The Most recent incidents and alerts section shows a graph of the number of alerts received and incidents created infrom the last 24 hours.

To examine the list of incidentsreview and prioritize their importance for assignment and investigation,incidents, you can:

  • Configure customizable columns (selectSelect Choose columns) to give you visibility into different characteristics of theshow details about each incident or the impactedits affected entities. This helps you make an informed decision regarding the prioritization ofUse these details to decide which incidents for analysis.to analyze first.

  • Use filteringApply filters to focus on a specific scenariothreat or threat. Applying filters on the incident queue canscenario. Filters help determineyou spot which incidents require immediate attention.need quick action.

From the default incident queue, select Filters to see aopen the Filters pane, from which you can specifypane. Use it to narrow the list to a specific set of incidents. Here's an example.

:::image type="content" source="media/pilot-deploy-investigate-respond/incidents-ss-incidents-filters.png" alt-text="A screenshot of the Filters pane of the Incidents & alerts section in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/incidents-ss-incidents-filters.png":::

  • Add comments

    Use comments forto track progress, add notes, or share other information based on your security team best practices. Thedetails. You can view the full comment history is available from the Comments and history option inon the incident details page of an incident.page.

For more information, see Manage incidents.

Step 5. Examine automated investigation and response with the Action center

DependingBased on how automated investigation and response capabilities are configuredyour organization's setup, remediation actions run automatically or wait for your organization, remediationsecurity team to approve them. The Action center lists all actions are taken automatically or only upon approval by your security operations team. All actions,in one place, whether pending or completed, are listed in the Action center, which lists pending and completed remediation actions for yourdone. It covers devices, email & collaboration content, and identities in one location.identities.

Here's an example.

:::image type="content" source="media/m3d-action-center-unified.png" alt-text="A screenshot of the Unified Action center in the Microsoft Defender portal." lightbox="media/m3d-action-center-unified.png":::

From the Action center, you can select pending actions and thenactions. Then approve or reject them in the flyout pane. Here's an example.

:::image type="content" source="media/air-actioncenter-itemselected.png" alt-text="A screenshot of the pane displaying the options to approve or reject an action in the Microsoft Defender portal." lightbox="media/air-actioncenter-itemselected.png":::

Approve (or reject)or reject pending actions as soon as possible so thatyou can. This helps your automated investigations can proceed and complete in a timely manner.finish on time.

For more information, see Automated investigation and response and Action center.

[!VIDEO https://learn-video.azurefd.net/vod/player?id=197cbd32-a06e-4efc-ade0-0c9875d7b105]

If the optional fileless PowerShell attack simulation were a real attack that had already reached the credential access stage, you can use advanced hunting at any point in the incident investigation to proactivelyinvestigation. Advanced hunting lets you search through events and records in the network using what you already know from the generated alerts and affected entities.

For instance, based on information inexample, use info from the User and IP address reconnaissance (SMB) alert, you can usealert to query the IdentityDirectoryEvents table to find all thefor SMB session enumeration events, orevents. You can also find more discovery activitiesactivity in various other protocols in Microsoft Defender for Identity data usingby querying the IdentityQueryEvents table.

Hunting environment requirements

There's a single internal mailbox and device required for this simulation. You'll also need an external email account to send the test message.

  1. Verify that your tenant has enabled Microsoft Defender.

  2. Identify a target mailbox to be used for receiving email.

    • This mailbox must be monitored by Microsoft Defender for Office 365
    1. Select Run query. You might have differing results depending on your pilot environment.
  :::image type="content" source="media/pilot-deploy-investigate-respond/advanced-hunting-incident-response-try-1.png" alt-text="A screenshot of the Advanced Hunting page in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/advanced-hunting-incident-response-try-1.png":::

  1. Now that you have verified that you can see the email, add a filter for the attachments. Focus on all emails with attachments in the environment. For this simulation, focus on inbound emails, not those that are being sent out from your environment. Remove any filters you have added to locate your message and add "| where AttachmentCount > 0 and EmailDirection == "Inbound""

    The following query returns only inbound emails that have attachments, which narrows the results from your initial query: 

    EmailEvents

  2. Next, include the information about the attachment (such as: file name, hashes) to your result set. To do so, join the EmailAttachmentInfo table. The common fields to use for joining, in this case are NetworkMessageId and RecipientObjectId.

    The following query builds on the previous one by joining the EmailAttachmentInfo table to add attachment details (such as file name and hashes) to your results. It also renames the timestamp field to EmailTimestamp so you can distinguish email timestamps from file action timestamps in later steps. 

    EmailEvents

  3. Next, use the SHA256 value from the EmailAttachmentInfo table to find DeviceFileEvents (file actions that happened on the endpoint) for that hash. The common field here will be the SHA256 hash for the attachment.

    The following query extends the previous one by joining the DeviceFileEvents table using the SHA256 hash. This correlates email attachments with file actions on the endpoint, so you can see which devices received the file and what happened to it. The results include endpoint details from Microsoft Defender for Endpoint, such as device name, action type (filtered to FileCreated events), file storage location, and the account name associated with the process. 

    EmailEvents

:::image type="content" source="media/pilot-deploy-investigate-respond/fig23.png" alt-text="A screenshot of the Alert details page in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/fig23.png":::

Ensure that you fill out the fields with clarity to help give the next user an informed decision about this detection rule alert.

  4. Select what entities are impacted in this alert. In this case, select Device and Mailbox.

    :::image type="content" source="media/pilot-deploy-investigate-respond/fig24.png" alt-text="A screenshot of the Impacted entities details page in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/fig24.png":::

  5. Determine what actions should take place if the alert is triggered. For this detection rule, run an antivirus scan, though other actions could be taken.

    :::image type="content" source="media/pilot-deploy-investigate-respond/fig25.png" alt-text="A screenshot of the Actions page in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/fig25.png":::

    :::image type="content" source="media/pilot-deploy-investigate-respond/fig26.png" alt-text="A screenshot of the Scope page in the Microsoft Defender portal." lightbox="media/pilot-deploy-investigate-respond/fig26.png":::

    For this Microsoft Defender XDR pilot deployment, you might want to limit this rule to a subset of testing devices in your production environment.

  6. Select Create. Then, select Custom detection rules from the navigation panel.

Next steps

Incorporate information from Investigate and respond with Microsoft Defender into your SecOps processes.