Incident-Response - 1

2026 (6)

May (1)

security: Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise

Microsoft Security Blog

2026-05-12

Microsoft Incident Response described an intrusion that used legitimate administrative mechanisms and a third-party compromise to stay hidden within routine operations. The report emphasizes that attackers increasingly avoid noisy exploits and custom malware by abusing trusted systems already present in the environment.

April (1)

security: Incident response for AI: Same fire, different fuel

Microsoft Security Blog

2026-04-15

Microsoft published a blog post on incident response for AI, focusing on how existing IR practices still apply while AI-specific telemetry, tools, and skills are needed. It frames AI incidents as similar to traditional response work but with different signals and operational needs.

March (3)

security: Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started

Microsoft Security Blog

2026-03-23

Microsoft Defender blocked a human-operated ransomware attack that used Group Policy Objects (GPOs) to disable defenses and deploy encryption at scale. Predictive shielding hardened 700 devices in time, preventing any GPO-based encryptions and blocking most of the attempted impact.

security: Help on the line: How a Microsoft Teams support call led to compromise

Microsoft Security Blog

2026-03-16

Microsoft describes a DART investigation into a Teams voice-phishing attack that used deception and trusted Microsoft tools to enable an identity-led intrusion. The post focuses on how the compromise happened and how to prevent similar attacks.

azure: [Launched] Generally Available: Azure SRE Agent with new capabilities

Azure Updates

2026-03-11

Azure SRE Agent is now generally available. The GA release adds new capabilities focused on incident diagnosis, automated response workflows, and improving uptime while reducing operational toil.

February (1)

github: Enterprise-wide credential management tools for incident response

GitHub

2026-02-17

GitHub Enterprise Cloud adds enterprise-wide credential management actions for enterprise owners to use during high-impact security incident response.