We’re excited to announce the Microsoft Incident Response Ninja Hub. This page includes a compilation of guides and resources that the Microsoft Incident Response team has developed on threat hunting, case studies, incident response guides, and more. Many of these pieces were also developed in collaboration with Microsoft’s partners across Microsoft Security, providing a unique view into how the Microsoft Security ecosystem leans on cross-team collaboration to protect our customers.
This page will be continually updated as the team develops and publishes more resources, so be sure to bookmark our Ninja Hub and stay up to date: https://aka.ms/MicrosoftIRNinjaHub
Incident Response (IR) best practices for security teams and leaders
-
Cybersecurity IR Workshop: The workshop you shouldn’t miss | Microsoft Security Blog - Sept 2026
- Navigating the Maze of Incident Response: Microsoft IR guide shares best practices for security teams and leaders
- Creating a proactive incident response plan | How to boost your incident response readiness
- The art and science behind Microsoft threat hunting: Part 1
- The art and science behind Microsoft threat hunting: Part 2
- The art and science behind Microsoft threat hunting: Part 3
- Microsoft Security tips to reduce risk in mergers and acquisitions
- How NOT to f-up your security incident response (cited in the Register)
AI
-
Securing AI agents: When AI tools move from reading to acting | Microsoft Security Blog - June 2026
- Detection and analyzing promot abuse in AI tools | Microsoft Security Blog- March 2026
- Considerations for Organizations Adopting AI | Security Insider - December 2025
- SesameOp: Novel backdoor uses OpenAI Assistants API for command and control | Microsoft Security Blog - November 2025
Deep dives and threat hunting guides
- One-page guides
- Cloud hunting and Microsoft Entra
-
Cloud forensics: Forensic readiness and incident response in Azure Virtual Desktop | Tech Community - February 2026
- Cloud forensics: Why enabling Microsoft Azure Storage Account logs matters | Tech Community - July 2025
- Cloud forensics: Prepare for the worst -implement security baselines for forensic readiness in Azure | Tech Community - August 2025
- Cloud forensics: Why enabling Microsoft Azure Key Vault logs matters
- Threat hunting with Microsoft Graph activity logs
- Hunting for MFA manipulations in Entra ID tenants using KQL
- Hunting in Azure subscriptions
- Good UAL Hunting
- Investigating malicious OAuth applications using the Unified Audit Log
- Forensic artifacts in Office 365 and where to find them
- Follow the Breadcrumbs with Microsoft IR & MDI: Working Together to Fight Identity-based Attacks
- How to investigate service provider trust chains in the cloud
-
- Techniques for threat hunting
Attacker tactics, techniques, and procedures explained
-
Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise | Microsoft Security Blog - May 2026
- StilachiRAT analysis: From system reconnaissance to cryptocurrency theft | Microsoft Security Blog - March 2025
- Proactive Measures: Safeguarding Against Vulnerable Driver Attacks with Effective Monitoring and Prevention Strategies
- Defenders beware: A case for post-ransomware investigations
- Token tactics: How to prevent, detect, and respond to cloud token theft
- Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign
- Guidance for investigating attacks using CVE-2023-23397
- Protect against CVE-2019-0708: BlueKeep
- IIS modules: The evolution of web shells and how to detect them
- Web shell attacks continue to rise
- Ghost in the shell: Investigating web shell attacks
- Tarrask malware uses scheduled tasks for defense evasion
Case studies
- Cyberattack Series
- Report 1: Solving one of NOBELIUM's most novel attacks
- Report 2: Healthy security habits to fight credential breaches
- Report 3: Patch me if you can: Cyberattack Series
- Report 4: Protecting credentials against social engineering
- Report 5: Build a stronger security strategy with proactive and reactive incident response | Microsoft Security Blog - February 2025
- Report 6: Retail at risk: How one alert uncovered a persistent cyberthreat | Microsoft Security Blog - October 2025
- Report 7: Imposter for hire: How fake people can gain very real access | Microsoft Security Blog - December 2025
- Report 8: Help on the line: How a Microsoft Teams support call led to a compromise | Microsoft Security Blog - March 2026
-
Report 9: One intrusion, two cyberattackers: Uncovering parallel threat activity | Microsoft Security Blog - June 2026
- Report 10: Beyond source code: A path to the keys to the kingdom | Microsoft Security Blog - September 2026
- Advanced Persistent Threats (APTs) and named Threat Actor groups
- Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees | Microsoft Security Blog | Microsoft Security Blog - April 2026
- Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction | Microsoft Security Blog - October 2023
- A guide to combatting human-operated ransomware: Part 1
- A guide to combatting human-operated ransomware: Part 2
- MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone
- Destructive malware targeting Ukrainian organizations
- DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
- Ransomware and case studies
Lessons from the field and compromise recovery how-to
- Compromise recovery
- Lessons from the field on securing your cloud
- When the shield becomes the sword: How misconfigured PAM bridges the tiering model | Tech Community April 2026
- Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory
- Microsoft Incident Response lessons on preventing cloud identity compromise
- Protect your business from password sprays with Microsoft DART recommendations
- Microsoft Incident Response tips for managing a mass password reset
- Effective strategies and technical recommendations for conducting Mass Password Resets during cybersecurity incidents
- How Microsoft Incident Response and Microsoft Defender for Identity work together
- A "quick wins" approach to securing Azure Active Directory and Office 365 and improving your security posture
- Using Microsoft Security APIs for Incident Response - Part 1
- Using Microsoft Security APIs for Incident Response - Part 2
- Microsoft Office 365—Do you have a false sense of cloud security?
- Lessons from the field on ransomware response
Long-form resources and books
- Microsoft Digital Defense Report, contributing since 2019 | October 2026
- Microsoft Defender for Endpoint in Depth: Take any organization's endpoint security to the next level
- The Definitive Guide to KQL: Using Kusto Query Language for operations, defending, and threat hunting (1st Edition)
Learn more about the Microsoft Incident Response team
- Meet DART, the people behind Microsoft Incident Response | Tech Community - December 2025
- Inside Microsoft Threat Intelligence: Calm in the chaos - How incident response is about more than technical fixes. By leading with empathy and collaboration | Security Insider - September 2025
- How the Microsoft Incident Response team helps customers remediate threats
- Microsoft Incident Response Retainer is generally available
- An integrated incident response solution with Microsoft and PwC
- Microsoft Intern Experience - Through the eyes of DART Incident Response (IR) interns
- Looking for a career in incident response? Consider the DART Infrastructure Engineer role!
- Decipher Podcast (2020): About Microsoft Detection and Response Team (DART)
- DART: the Microsoft cybersecurity team we hope you never meet
To stay up to date, follow blogs published to the Security Experts Tech Community Blog and to Microsoft Security Blog.
Updated Oct 14, 2026
Version 21.0
EmilyLiu
Microsoft
Microsoft
