Protect Copilot Studio AI Agents in Real Time with Microsoft Defender
Building AI agents has never been easier. Platforms like Microsoft Copilot Studio democratize the creation of AI agents and empower non-technical users to build intelligent agents that automate tasks and streamline business processes. These agents can answer questions, orchestrate complex tasks, and integrate with enterprise systems to boost productivity and creativity. Organizations are embracing a future where every team has AI agents working alongside them to increase efficiency and responsiveness. While AI agents unlock exciting new possibilities, they also introduce new security risks, most notably prompt injection attacks and a broader attack surface. Attackers are already testing ways to exploit them, such as abusing tool permissions, sneaking in malicious instructions, or tricking agents into sharing sensitive data. Prompt injection is especially concerning because it happens when an attacker feeds an agent malicious inputs to override the agent’s intended behavior. These risks aren’t due to flaws in Copilot Studio or any single platform — they’re a natural challenge that comes with democratizing AI development. As more people build and deploy agents, strong, real-time protection will be critical to keeping them secure. To help organizations safely unlock the potential of generative AI, Microsoft Defender has introduced innovations ranging from shadow AI discovery to out-of-the-box threat protection for both pre-built and custom-built generative AI apps. Today, we’re excited to take the next step in securing AI agents: Microsoft Defender now delivers real-time protection during agent runtime for AI agents built with Copilot Studio. It automatically stops agents from executing unsafe actions during runtime if suspicious behavior, such as a prompt injection attack attempt, is detected and notifies security teams with a detailed alert in the Defender portal. Defender’s AI agent runtime protection is part of our broader approach to securing Copilot Studio AI agents, as outlined in this blog post. Monitor AI agent runtime activities and detect prompt injection attacks Prompt injections are particularly dangerous because they exploit the very AI logic that powers these agents. A well-crafted input can trick an agent’s underlying language model into ignoring its safety guardrails or revealing secrets it was supposed to keep. With thousands of agents operating and interacting with external inputs, the risk of prompt injection is not theoretical - it’s a pressing concern that grows with every new agent deployed. The new real-time protection for AI agents built with Copilot Studio adds a safety net at the most critical point when the agent is running and acting. It helps safeguard AI agents during their operation, reducing the chance that malicious inputs can exploit them during runtime. Microsoft Defender now monitors agent tool invocation calls in real time. If a suspicious or high-risk action is detected, such as a known prompt injection pattern, the action is blocked before it is executed. The agent halts processing and informs the user that their request was blocked due to a security risk. For example, if an HR chatbot agent is tricked by a hidden prompt to send out confidential salary information, Defender will detect this unauthorized action and block it before any tool is invoked. Investigate suspicious agent behaviors in a unified experience See the full attack story, not just the alerts. Today’s attacks are targeted and multi‑stage. When Defender stops risky Copilot Studio AI agent activity at runtime, it raises an alert - and immediately begins correlating related signals across email, endpoints, identities, apps, and cloud into a single incident. That builds the complete attack narrative, often before anyone even opens the queue, so the SOC can see how they’re being targeted and what to do next. In the Microsoft Defender portal, incidents arrive enriched with timelines, entity relationships, relevant TTPs, and threat intelligence. Automated investigation and response gathers evidence, determines scope, and recommends or executes remediation to cut triage time. With Security Copilot embedded, analysts get instant incident summaries, guided response and hunting in natural language, and contextualize threat intelligence to accelerate deeper analysis and stay ahead of threats. If you use Microsoft Sentinel, the unified SOC experience brings Defender XDR incidents together with third‑party data. And with the new Microsoft Sentinel data lake (preview), teams can retain and analyze years of security data in one place, then hunt across that history using natural‑language prompts that Copilot translates to KQL. Because runtime protection already stops the unsafe actions of Copilot Studio AI agents, most single alerts don’t require immediate intervention. But the SOC still needs to know when they’re being persistently targeted. Defender automatically flags emerging patterns, such as sustained activity from the same actor or technique, and, when warranted and a supporting scenario like ransomware, can trigger automatic attack disruption to contain active threats while analysts' review. For Copilot Studio builders, Defender extends the same protection to AI agents: real‑time runtime protection helps prevent unsafe actions and prompt‑injection attempts, and detections are automatically correlated and investigated, without moving data outside a trusted, industry‑leading XDR. By embedding security into the runtime of AI agents, Microsoft Defender helps organizations embrace the full potential of Copilot Studio while maintaining the trust and control they need. Real-time protection during agent runtime is a foundational step in Microsoft’s journey to secure the future of AI agents, laying the foundation for more advanced capabilities coming soon to Microsoft Defender. It reflects our belief that innovation and security go hand in hand. With this new capability, organizations can feel more confident using AI agents, knowing that Microsoft Defender is monitoring in real time to keep their environments protected. Learn more: Read the blog to learn more about securing Copilot Studio agents Check the documentation to learn how Defender blocks agent tool invocation in real time Explore how to build and customize agents with Copilot Studio Agent BuilderMicrosoft Sentinel’s AI-driven UEBA ushers in the next era of behavioral analytics
Co-author - Ashwin Patil Security teams today face an overwhelming challenge: every data point is now a potential security signal and SOCs are drowning in complex logs, trying to find the needle in the haystack. Microsoft Sentinel User and Entity Behavior Analytics (UEBA) brings the power of AI to automatically surface anomalous behaviors, helping analysts cut through the noise, save time, and focus on what truly matters. Microsoft Sentinel UEBA has already helped SOCs uncover insider threats, detect compromised accounts, and reveal subtle attack signals that traditional rule-based methods often miss. These capabilities were previously powered by a core set of high-value data sources - such as sign-in activity, audit logs, and identity signals - that consistently delivered rich context and accurate detections. Today, we’re excited to announce a major expansion: Sentinel UEBA now supports six new data sources including Microsoft first- and third-party platforms like Azure, AWS, GCP, and Okta, bringing deeper visibility, broader context, and more powerful anomaly detection tailored to your environment. This isn’t just about ingesting more logs. It’s about transforming how SOCs understand behavior, detect threats, and prioritize response. With this evolution, analysts gain a unified, cross-platform view of user and entity behavior, enabling them to correlate signals, uncover hidden risks, and act faster with greater confidence. Newly supported data sources are built for real-world security use cases: Authentication activities MDE DeviceLogonEvents – Ideal for spotting lateral movement and unusual access. AADManagedIdentitySignInLogs – Critical for spotting stealthy abuse of non - human identities. AADServicePrincipalSignInLogs - Identifying anomalies in service principal usage such as token theft or over - privileged automation. Cloud platforms & identity management AWS CloudTrail Login Events - Surfaces risky AWS account activity based on AWS CloudTrail ConsoleLogin events and logon related attributes. GCP Audit Logs - Failed IAM Access, Captures denied access attempts indicating reconnaissance, brute force, or privilege misuse in GCP. Okta MFA & Auth Security Change Events – Flags MFA challenges, resets, and policy modifications that may reveal MFA fatigue, session hijacking, or policy tampering. Currently supports the Okta_CL table (unified Okta connector support coming soon). These sources feed directly into UEBA’s entity profiles and baselines - enriching users, devices, and service identities with behavioral context and anomalies that would otherwise be fragmented across platforms. This will complement our existing supported log sources - monitoring Entra ID sign-in logs, Azure Activity logs and Windows Security Events. Due to the unified schema available across data sources, UEBA enables feature-rich investigation and the capability to correlate across data sources, cross platform identities or devices insights, anomalies, and more. AI-powered UEBA that understands your environment Microsoft Sentinel UEBA goes beyond simple log collection - it continuously learns from your environment. By applying AI models trained on your organization’s behavioral data, UEBA builds dynamic baselines and peer groups, enabling it to spot truly anomalous activity. UBEA builds baselines from 10 days (for uncommon activities) to 6 months, both for the user and their dynamically calculated peers. Then, insights are surfaced on the activities and logs - such as an uncommon activity or first-time activity - not only for the user but among peers. Those insights are used by an advanced AI model to identify high confidence anomalies. So, if a user signs in for the first time from an uncommon location, a common pattern in the environment due to reliance on global vendors, for example, then this will not be identified as an anomaly, keeping the noise down. However, in a tightly controlled environment, this same behavior can be an indication of an attack and will surface in the Anomalies table. Including those signals in custom detections can help affect the severity of an alert. So, while logic is maintained, the SOC is focused on the right priorities. How to use UEBA for maximum impact Security teams can leverage UEBA in several key ways. All the examples below leverage UEBA’s dynamic behavioral baselines looking back up to 6 months. Teams can also leverage the hunting queries from the "UEBA essentials" solution in Microsoft Sentinel's Content Hub. Behavior Analytics: Detect unusual logon times, MFA fatigue, or service principal misuse across hybrid environments. Get visibility into geo-location of events and Threat Intelligence insights. Here’s an example of how you can easily discover Accounts authenticating without MFA and from uncommonly connected countries using UEBA behaviorAnalytics table: BehaviorAnalytics | where TimeGenerated > ago(7d) | where EventSource == "AwsConsoleSignIn" | where ActionType == "ConsoleLogin" and ActivityType == "signin.amazonaws.com" | where ActivityInsights.IsMfaUsed == "No" | where ActivityInsights.CountryUncommonlyConnectedFromInTenant == True | evaluate bag_unpack(UsersInsights, "AWS_") | where InvestigationPriority > 0 // Filter noise - uncomment if you want to see low fidelity noise | project TimeGenerated, _WorkspaceId, ActionType, ActivityType, InvestigationPriority, SourceIPAddress, SourceIPLocation, AWS_UserIdentityType, AWS_UserIdentityAccountId, AWS_UserIdentityArn Anomaly detection Identify lateral movement, dormant account reactivation, or brute-force attempts, even when they span cloud platforms. Below are examples of how to discover UEBA Anomalous AwsCloudTrail anomalies via various UEBA activity insights or device insights attributes: Anomalies | where AnomalyTemplateName in ( "UEBA Anomalous Logon in AwsCloudTrail", // AWS ClousTrail anomalies "UEBA Anomalous MFA Failures in Okta_CL", "UEBA Anomalous Activity in Okta_CL", // Okta Anomalies "UEBA Anomalous Activity in GCP Audit Logs", // GCP Failed IAM access anomalies "UEBA Anomalous Authentication" // For Authentication related anomalies ) | project TimeGenerated, _WorkspaceId, AnomalyTemplateName, AnomalyScore, Description, AnomalyDetails, ActivityInsights, DeviceInsights, UserInsights, Tactics, Techniques Alert optimization Use UEBA signals to dynamically adjust alert severity in custom detections—turning noisy alerts into high-fidelity detections. The example below shows all the users with anomalous sign in patterns based on UEBA. Joining the results with any of the AWS alerts with same AWS identity will increase fidelity. BehaviorAnalytics | where TimeGenerated > ago(7d) | where EventSource == "AwsConsoleSignIn" | where ActionType == "ConsoleLogin" and ActivityType == "signin.amazonaws.com" | where ActivityInsights.FirstTimeConnectionViaISPInTenant == True or ActivityInsights.FirstTimeUserConnectedFromCountry == True | evaluate bag_unpack(UsersInsights, "AWS_") | where InvestigationPriority > 0 // Filter noise - uncomment if you want to see low fidelity noise | project TimeGenerated, _WorkspaceId, ActionType, ActivityType, InvestigationPriority, SourceIPAddress, SourceIPLocation, AWS_UserIdentityType, AWS_UserIdentityAccountId, AWS_UserIdentityArn, ActivityInsights | evaluate bag_unpack(ActivityInsights) Another example shows anomalous key vault access from service principal with uncommon source country location. Joining this activity with other alerts from the same service principle increases fidelity of the alerts. You can also join the anomaly UEBA Anomalous Authentication with other alerts from the same identity to bring the full power of UEBA into your detections. BehaviorAnalytics | where TimeGenerated > ago(1d) | where EventSource == "Authentication" and SourceSystem == "AAD" | evaluate bag_unpack(ActivityInsights) | where LogonMethod == "Service Principal" and Resource == "Azure Key Vault" | where ActionUncommonlyPerformedByUser == "True" and CountryUncommonlyConnectedFromByUser == "True" | where InvestigationPriority > 0 Final thoughts This release marks a new chapter for Sentinel UEBA—bringing together AI, behavioral analytics, and cross-cloud and identity management visibility to help defenders stay ahead of threats. If you haven’t explored UEBA yet, now’s the time. Enable it in your workspace settings and don’t forget to enable anomalies as well (in Anomalies settings). And if you’re already using it, these new sources will help you unlock even more value. Stay tuned for our upcoming Ninja show and webinar (register at aka.ms/secwebinars), where we’ll dive deeper into use cases. Until then, explore the new sources, use the UEBA workbook, update your watchlists, and let UEBA do the heavy lifting. UEBA onboarding and setting documentation Identify threats using UEBA UEBA enrichments and insights reference UEBA anomalies reference
Protect against OAuth Attacks in Salesforce with Microsoft Defender
An ongoing campaign of security incidents has been observed across multiple large enterprises, involving unauthorized access to the organizational Salesforce CRM systems using OAuth applications - resulting in data breaches and exfiltration - underscore both the escalating pace of cloud-based attacks and the importance of addressing SaaS application security. In response, Salesforce has started to enforce improved OAuth app blocking policies. The activity has been partially attributed to a threat actor publicly dubbed and known as ShinyHunters, which led to breaches at multiple global firms. These incidents demonstrate how OAuth trusts can be weaponized: attackers use OAuth-based attacks because they can bypass traditional security controls focused on devices, are difficult to detect, and provide direct access to business-critical systems such as CRM and Support systems which often may enable attackers to extract additional tokens for other SaaS applications for further lateral movements. Based on the information and intel observed so far, there are two recent campaigns both focused to target Salesforce instances of multiple large organizations in different ways and with different intrusion techniques. The first wave of attacks (disclosed earlier in June 2025) seems to be based on social engineering and vishing to abuse permissions through a modified version of Salesforce Data Loader application; the second, more recent campaign surfaced during end of August 2025, instead seems to originate from a separate security incident reported by Salesloft Drift vendor and affecting their cloud application integrated with Salesforce. In this blog post, we will delve only into the earlier Salesforce OAuth attack campaign and provide guidance on how organizations can use Microsoft Defender to protect against this and similar SaaS attack campaigns. Specifically, we will: Break down the recent Salesforce OAuth attacks abusing a modified Data Loader application Demonstrate how Defender capabilities can detect and discover intrusions Provide an overview of analyst investigation tools in Defender Highlight response actions available to contain the threat and harden your organizational security posture Attack overview – OAuth consent phishing This attack combined social engineering tactics with OAuth abuse to steal data and extort victims. Unlike malware-based intrusions, this campaign relied on exploiting the OAuth authorization flow of a trusted SaaS service. Below is an overview of how the attack unfolded and its high impact: Figure 1: Attack chain illustration Phase 1: Initial vishing contact The attack began with a phone call. Posing as IT support—sometimes even claiming to be from Salesforce—threat actors contacted company employees under the guise of resolving a “support ticket” or other urgent issue. The goal was simple: build trust and prepare the victim to follow instructions. Phase 2: Malicious OAuth app consent Once trust was established, the caller guided the victim to Salesforce’s Connected Apps page and instructed them to enter a special “connection code.” Unbeknownst to the user, this code corresponded to a malicious OAuth app-controlled registration by the attackers—a malicious version of the Salesforce Data Loader tool. By granting consent, the victim unknowingly gave the attackers OAuth access to their Salesforce data. , Salesforce , Salesforce , Salesforce, admin page Phase 3: Data exfiltration and lateral movement After obtaining the OAuth refresh token from the connected app, the attackers exploited it to query and download large amounts of Salesforce CRM data such as customer information, support tickets and sales records. In some cases, the exfiltration began during or right after the call—so quickly that security teams initially didn’t realize an attack had occurred. All data requests appeared as legitimate API calls from an authorized app, helping the attackers blend in. Additionally, the attackers often collected the user’s login credentials and MFA codes during the call under the guise of ‘verification.’ Using the stolen credentials (for providers like Okta), the threat actors demonstrated a form of “lateral movement” to other SaaS apps—like accessing Office 365 mailboxes, file storage services, or Slack—to steal additional data and expand their foothold. Illustration Phase 4: Extortion and threats With the valuable data in hand, the threat actor moved to extortion. They contacted the company, demanding ransom payments (often in cryptocurrency) under threat of leaking the stolen data publicly. In some cases, they falsely claimed ties to other notable extortion groups to pressure victims. If a victim refused to pay, the group would follow through by posting the data online or in dark web marketplaces. This double-pronged impact—data breach and public leak—put organizations in a vulnerable position. According to reports, the attackers primarily relied on email-based extortion rather than immediate data dumps, but the constant risk of a large-scale leak kept victims on edge. OAuth application supply chain attack While organizations responded to the above-mentioned consent attacks involving Data Loader application, major firms reported later another wave of OAuth app-based attacks targeting Salesforce instances of the victims. In this second campaign, the threat actors leveraged compromised OAuth tokens potentially captured from the Salesloft Drift app, a third-party Salesforce integration for automating sales workflows, to gain unauthorized access to hundreds of Salesforce environments. As the investigation on these attacks continue and it’s evolving, the key insight is the unusual spike in Salesforce API activities and access anomalies in the victim organizations during the attack. Protect with Defender Defender provides the visibility, detection, and remediation capabilities needed to protect your environment against these stealthy, high-impact OAuth-based attacks. Discovery of OAuth applications Early detection is essential in defending against OAuth-based attacks. Defender can discover suspicious activities such as registration of OAuth applications that could be easily missed. In this scenario described, there were several subtle red flags that Defender is equipped to unveil. To allow visibility, first connect the Salesforce app in Defender by navigating to Settings → Cloud Apps → App connectors and confirming prerequisites (API enabled, Event Monitoring). See detailed instruction in the Defender public documentation. This step is required for all subsequent steps. Defender provides visibility into third-party OAuth apps that have been granted access in your environment. This unified view allows security administrators to see, for example, that a new app called “My Ticket Portal” or “Data Loader” (with publisher “Unknown”) was authorized by users and request read/write access to data. Application assets page, Salesforce tab, Defender portal By proactively using Defender, organizations can be alerted within minutes of the malicious consent, or as soon as the attacker starts pulling unusual amounts of data, rather than discovering a breach days later after significant data loss has already occurred. Investigation: Understanding the full scope of the attack Once a suspicious OAuth is detected, Defender provides a rich toolset to investigate the full scope of the incident. Below is an example of how security analysts can use Defender to investigate the attack in-depth: Advanced hunting: To get more visibility and to investigate ongoing events in-depth, security teams can use advanced hunting queries to explore organization-wide data and identify ongoing malicious activity. Audit Salesforce connected applications to ensure that only trusted and approved applications are in use. The following query will shed light on Salesforce Oauth apps with suspicious API usage, suggesting malicious behavior. CloudAppEvents | where Application == "Salesforce" | where ActionType == "ApiTotalUsage" // Event for REST/SOAP/Bulk API query | extend ConnectedAppName = tostring(RawEventData.CONNECTED_APP_NAME), ConnectedAppId = tostring(RawEventData.CONNECTED_APP_ID), UserName = tostring(RawEventData.USER_NAME) | where isnotempty(ConnectedAppName) | summarize RequestCount=count(), UniqueUsers=dcount(UserName), Users=make_set(UserName) by ConnectedAppName, ConnectedAppId Salesforce activity records are pulled for that user around the time of the incident. A surge of API calls like Query or Data Export operations initiated by the OAuth app. For example, Defender’s log might show dozens of queries executed by “My Ticket Portal (OAuth App)” on Salesforce objects (Accounts, Contacts, Opportunities) within a short timeframe. CloudAppEvents | where Application == "Salesforce" | where ActionType == "ApiTotalUsage" | extend ConnectedAppName = tostring(RawEventData.CONNECTED_APP_NAME), ObjectType = tostring(RawEventData.ENTITY_NAME) | where isnotempty(ConnectedAppName) | summarize RequestCount=count() by bin(Timestamp, 30m), ConnectedAppName, ObjectType | render timechart Hunt for IOCs like malicious IPs, UserAgents etc. used by threat actors to look for malicious activity. For instance, here is a list of IOCs shared by Salesloft recently. The following query can be used in Advanced Hunting to search for any activity from that list. CloudAppEvents | where Application == “Salesforce” | where IPAddress in ("154.41.95.2","176.65.149.100","179.43.159.198","185.130.47.58","185.207.107.130","185.220.101.133","185.220.101.143","185.220.101.164","185.220.101.167","185","220.101.169","185.220.101.180","185.220.101.185","185.220.101.33","192.42.116.179","192.42.116.20","194.15.36.117","195.47.238.178","195.47.238.83","208.68.36.90","44.215.108.109") In addition to that list, the following indicators have been observed performing malicious activity: Value Type Description 193[.]36[.]132[.]21 IPv4 Tor exit node If the attackers also used Okta credentials to log into Microsoft 365, the analyst can check the Microsoft Entra ID sign-in logs or Defender logs for unusual sign-ins. Analysts will be able to see if the same user account had successful logins to Microsoft 365 from a specific IP shortly after the Salesforce breach. Review alerts relevant to Salesforce activity: Look for any alerts with the title “Possible Salesforce scraping activity” in the Alerts and/or Incidents pages. This alert is triggered when a large number of Salesforce API requests from the same account are observed in a short period of time. This might also indicate an automated scraping activity. It's important to investigate this activity to determine whether a threat actor might be monitoring or launching an attack so you can mitigate it, or if it has something to do with an internal audit. Note that this alert is not targeted at the attacks referenced earlier, but may detect the activity involved - as this pattern matches the signature of the attack described in the blog post. Security admins also have the option to create ad-hoc custom detection rules for specific behaviors they want to track to detect OAuth apps attacks in the future. Response and remediation When attackers exploit OAuth app consent, speed is critical. Defender helps security teams move fast by revoking malicious apps, containing compromised accounts, and guiding admins through remediation steps in Salesforce. Remove app access: With Defender, security teams can proactively identify OAuth Revoke app and ban options in Defender Figure 6: Revoke app option, Salesforce admin pageapps in the Applications page and either ban them or fully revoke their permissions. See more in our documentation. Contain the user: Require user to sign in again (session invalidation) and, if needed, Suspend user in Salesforce via governance actions. In case the consenting user was also compromised. Manual remediation in Salesforce: Application owners and security teams may also reach the registered OAuth application in Salesforce admin page via Home → Administration → Users → Users → OAuth Apps → Revoke; to manually revoke them, if preferred. Harden Salesforce: Security teams or application owners can require admin approval for critical connected apps in Salesforce; and regularly audit connected apps. Additionally, Salesforce has introduced new permissions such as: “Approve Uninstalled Connected Apps” user permission which must be assigned to users with careful consideration as this will allow them to authorize to uninstalled apps in the organization. Revoke app option, Salesforce admin page API Access Control which can be used to manage access to Salesforce APIs through a connected app in your organization. This Salesforce article can help you prepare for these upcoming changes. In case of supply chain attacks, track updates and follow vendor remediations in timely and careful manner. For instance, refer to Salesloft's latest security update here. Focus on internal education: Security teams are encouraged to raise awareness within their organization on the importance of not giving authorization keys over any medium (inc. via phone calls), and assimilate the understanding that OAuth registration is equivalent, in its harming potential, to giving away their personal password. This attack demonstrated a sophisticated SaaS OAuth-based technique. With no malware deployed and no vulnerability exploited, traditional security tools focused on endpoint threats or network signatures offered little defense. It also highlights a growing trend in recent SaaS attacks, where adversaries use new methods for lateral movement, persistence, defense evasion, and data exfiltration across SaaS environments, all without direct interaction with physical devices. Defender address this challenge by monitoring signals across SaaS services, detecting anomalies such as unusual OAuth activities, and enabling security teams to quickly investigate and stop such threats. Defender protects both human and non-human identities, while giving customers full visibility into their SaaS applications landscape with capabilities like app-to-app protection, SaaS security posture management, continuous threat protection, and more. Learn more: Learn more about SaaS security with Microsoft Defender Integrate the Salesforce app Learn more about governance actions for oAuth applications Salesloft security response: https://trust.salesloft.com/?uid=Drift%2FSalesforce+Security+Notification Salesforce security response: Ongoing Security Response to Third-Party App Incident
Custom detection rules get a boost—explore what’s new in Microsoft Defender
Co-author - Jeremy Tan In today's rapidly evolving cybersecurity landscape, staying ahead of threats is crucial. Microsoft Defender's custom detection rules offer a powerful way to proactively monitor and respond to security threats. These user-defined rules can be configured to run at regular intervals to detect security threats—generating alerts and triggering response actions when threats are detected. If you are a Microsoft Sentinel user and have connected your Sentinel workspace to Microsoft Defender, you are probably more familiar with analytics rules in Microsoft Sentinel and are looking to explore the capabilities and benefits of custom detections. Understanding and leveraging custom detection rules can significantly enhance your organization's security posture. This blog will delve into the benefits of custom detections and showcase scenarios that highlight their capabilities, helping you make the most of this robust feature. We are excited to release these brand-new enhancements that are now available in public preview. What’s new in custom detections? The improvements in custom detections aim to enhance their functionality and usability, making it easier to manage and respond to security threats effectively. Unified user defined detection list: Manage all your user-defined detections from Microsoft Defender XDR and Microsoft Sentinel in one place. Filtering capabilities for every column. Search freely using rule title or rule ID. View the new workspace ID column (filterable) for multi-workspace organizations that onboarded multiple workspaces to the unified SOC platform. Manage all detections from MTO portal across all your tenants. Show details pane for every rule (whether custom detection or analytics rule). Perform the following actions on rules: Turn on/off Delete Edit Run (only for custom detections) Open rule’s page (only for custom detections) Migrate eligible scheduled custom detections to near real-time custom detections with one click using the new migration tool. Dynamic alert titles and descriptions: Dynamically craft your alert’s title and description using the results of your query to make them accurate and indicative. Advanced entity mapping: Link a wide range of entity types to your alerts. Enrich alerts with custom details: Surface details to display in the alert side panel. Support Sentinel-only data: Custom detections support Microsoft Sentinel data only without dependency on Microsoft Defender XDR data. Flexible and high frequency support for Sentinel data: Custom detections support high and flexible frequency for Microsoft Sentinel data. The benefits of custom detections Let’s examine some of the key benefits of custom detections: Query data from Defender XDR and Sentinel seamlessly: You can create custom detection rules that query data from both Microsoft Sentinel and Defender XDR tables seamlessly, without the need of sending Defender XDR data to Sentinel. Cost efficiency: Save on ingestion costs if you don’t need to retain Microsoft Defender XDR data in analytics tier for more than 30 days but have detection use cases involving both Defender XDR and Sentinel data. Detect threats immediately and remove dependency on quick ingestion: near real time (NRT) custom detections monitor events as they stream, while standard custom detections evaluate both the event ingestion time and the time the event was generated. Unlimited NRT detections: NRT custom detections are unlimited, you can create as many as you need. Since they are based on a streaming technology, they are not generating any load on the system. Native remediation actions: You can configure custom detection rule to automatically take actions on devices, files, users, or emails that are returned by the query when your detection query is correlating Defender XDR and Microsoft Sentinel data, or Defender XDR data only. Entity mapping: Entities are automatically mapped to the alert for all XDR tables. Out of the box alert de-duplication: To reduce alert fatigue when alert generated with the same impacted entities, custom details, title and description - they will merge to the same alert (keeping all raw events linked to the single alert). With this capability you don’t need to worry about duplicated alerts – we take care of it for you. Built-in functions: You can leverage built-in enrichment functions when you build your custom detection queries, such as FileProfile(), SeenBy(), DeviceFromIP() and AssignedIPAddresses(). Extended lookback period: Custom detections have a long lookback period of up to 30 days for rules that run once a day, ideal for historical trending detections. Common scenarios To truly understand the power and versatility of custom detection rules in Microsoft Defender, it's essential to see them in action. In this section, we'll explore several common use cases that demonstrate how these new capabilities can be leveraged to enhance your organization's security posture. These scenarios highlight the benefits of the capabilities, providing you with actionable insights to implement in your own environment. Use Case – detecting potential malicious activity In this use case, we aim to detect potential malicious activity by monitoring logon attempts from different IP addresses. We will implement a custom detection rule that: Monitors successful logon by a user from one IP address and a failed logon attempt from a different IP address (may indicate a malicious attempt at password guessing with a known account). Enriches alerts with user's information from Microsoft Defender for Identity’s IdentityInfo table, including Job title, Department, Manager’s name, and assigned roles. If the user has been found in the 'Terminated Employees’ watchlist, indicating that the user has been notified for termination or marked as terminated, reflect this in the alert name and description. Runs once a day with a lookback period of 30 days, avoiding duplicate alerts on subsequent intervals. Let’s walk through the creation of the custom detection rule and examine the outcome. 1. Here is the sample KQL query we will run in advanced hunting page to create the custom detection. let logonDiff = 10m; let Terminated_Watchlist = _GetWatchlist("TerminatedEmployees") | project tolower(SearchKey);// Get the TerminiatedEmploees Watchlist let aadFunc = (tableName:string) { table(tableName) | where ResultType == "0" | where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") // To remove false-positives, add more Apps to this array | extend SuccessIPv6Block = strcat(split(IPAddress, ":")[0], ":", split(IPAddress, ":")[1], ":", split(IPAddress, ":")[2], ":", split(IPAddress, ":")[3]) | extend SuccessIPv4Block = strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1]) | project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, SuccessLocation = Location, AppDisplayName, SuccessIPBlock = iff(IPAddress contains ":", strcat(split(IPAddress, ":")[0], ":", split(IPAddress, ":")[1]), strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1])), Type | join kind= inner ( table(tableName) | where ResultType !in ("0", "50140") | where ResultDescription !~ "Other" | where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") | project FailedLogonTime = TimeGenerated, UserPrincipalName, FailedIPAddress = IPAddress, FailedLocation = Location, AppDisplayName, ResultType, ResultDescription, Type ) on UserPrincipalName, AppDisplayName | where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and FailedIPAddress !startswith SuccessIPBlock // Compare the success and failed logon time | summarize FailedLogonTime = max(FailedLogonTime), SuccessLogonTime = max(SuccessLogonTime) by UserPrincipalName, SuccessIPAddress, SuccessLocation, AppDisplayName, FailedIPAddress, FailedLocation, ResultType, ResultDescription, Type | extend Timestamp = SuccessLogonTime | extend UserInTerminatedWatchlist = iif(UserPrincipalName in (Terminated_Watchlist), 'True', 'False') // Check if the impacted user is found in the Watchlist | extend AlertName = iif(UserInTerminatedWatchlist == 'True', "Successful logon by a 'Terminated Employees Watchlist' user from one IP and a failed logon attempt from a different IP","Successful logon from IP and failure from a different IP") // This is the define the dynamic alert value | extend AlertDescription = iif(UserInTerminatedWatchlist == 'True', "A Successful logon by a 'Terminated Employees Watchlist' user onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account). ","A user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account).") // This is to define the dynamic alert description | extend UserPrincipalName = tolower(UserPrincipalName)}; let aadSignin = aadFunc("SigninLogs"); let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs"); union isfuzzy=true aadSignin, aadNonInt | extend Name = tostring(split(UserPrincipalName,'@',0)[0]), UPNSuffix = tostring(split(UserPrincipalName,'@',1)[0]) | join kind=leftouter ( IdentityInfo // Correlate with IdentityInfo table | summarize arg_max (TimeGenerated,AccountObjectId, Department, JobTitle, Manager, AssignedRoles, ReportId, IsAccountEnabled) by AccountUpn | extend UserPrincipalName=tolower(AccountUpn) ) on UserPrincipalName 2. On the top right corner of the advance hunting page, select ‘create custom detection’ under Manage rules. 3. Populate the relevant rule’s information. 4. Specify alert title and description by referencing the AlertName and AlertDescription fields defined in the query, as we will dynamically craft the alert title and description, depending on whether the impacted user is found in the 'Terminated Employees’ watchlist. 5. In the entity mapping section, you will find some entity mappings that we have pre-populated for you, which would save you some time and effort. You can update or add the mappings as you wish. 6. Let’s add some additional mappings. In this example, I will add IP entities under Related Evidence. 7. In the Custom details section, I will add the following key-value pairs to surface additional information of the impact user in the alert. 8. On the Automated actions page, because we are correlating Sentinel data with Defender XDR table (IdentityInfo), you have the option to select first-party remediation actions, which is ‘Mark user as compromised’ in our case. 9. Review the configuration of the rule and click Submit. 10. Now, let’s examine how the incident/alert would look. Below is a sample incident triggered. 11. Select the alert and you will find the custom details on the right pane, surfacing additional information such as Job title, Department, Manager’s name and Assigned roles that we configured. 12. The impacted user from the above incident was not found in the 'Terminated Employees’ watchlist. Now, let’s examine how the incident/alert would look when the impacted user is found in the watchlist. 13. In my environment, I have configured the watchlist and will be using ‘MeganB’ for simulation. 14. Notice how the alert title and description is different from the one generated earlier, to reflect user found in the watchlist. 15. The rule will run once a day with a look back period of 30 days. However, custom detection will not create duplicate alerts if the same impacted entities are found in the subsequent runs. Instead, you will find the Last activity time being updated and more events showing up in the result table of the alert page. Conclusion Custom detection rules in Microsoft Defender offer a powerful and flexible way to enhance your organization's security posture. By leveraging these user-defined rules, you can proactively monitor and respond to security threats, generating detailed and actionable alerts. The recent enhancements—such as unified detection lists, dynamic alert titles, and advanced entity mapping—further improve the functionality and usability of custom detections. Ready to enhance your threat detection capabilities? Start exploring and implementing custom detection rules in Microsoft Defender today to safeguard your digital assets and maintain a strong security posture. Useful links Overview of custom detections in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn Create and manage custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft LearnMonthly news - September 2025
Microsoft Defender Monthly news - September 2025 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from August 2025. Defender for Cloud has it's own Monthly News post, have a look at their blog space. New Virtual Ninja Show episodes: Announcing Microsoft Sentinel data lake. Inside the new Phishing Triage Agent in Security Copilot. Microsoft Defender Public Preview items in advanced hunting: The new CloudStorageAggregatedEvents table is now available and brings aggregated storage activity logs, such as operations, authentication details, access sources, and success/failure counts, from Defender for Cloud into a single, queryable schema. You can now investigate Microsoft Defender for Cloud behaviors. For more information, see Investigate behaviors with advanced hunting. The IdentityEvents table contains information about identity events obtained from other cloud identity service providers. You can now enrich your custom detection rules in advanced hunting by creating dynamic alert titles and descriptions, select more impacted entities, and add custom details to display in the alert side panel. Microsoft Sentinel customers that are onboarded to Microsoft Defender also now have the option to customize the alert frequency when the rule is based only on data that is ingested to Sentinel. The number of query results displayed in the Microsoft Defender portal has been increased to 100,000. General Availability item in advanced hunting: you can now view all your user-defined rules - both custom detection rules and analytics rules - in the Detection rules page. This feature also brings the following improvements: You can now filter for every column (in addition to Frequency and Organizational scope). For multiworkspace organizations that have onboarded multiple workspaces to Microsoft Defender, you can now view the Workspace ID column and filter by workspace. You can now view the details pane even for analytics rules. You can now perform the following actions on analytics rules: Turn on/off, Delete, Edit. (General Availability) Defender Experts for XDR and Defender Experts for Hunting customers can now expand their service coverage to include server and cloud workloads protected by Defender for Cloud through the respective add-ons, Microsoft Defender Experts for Servers and Microsoft Defender Experts for Hunting - Servers. Learn more (General Availability) Defender Experts for XDR customers can now incorporate third-party network signals for enrichment, which could allow our security analysts to not only gain a more comprehensive view of an attack's path that allows for faster and more thorough detection and response, but also provide customers with a more holistic view of the threat in their environments. (General Availability) The Sensitivity label filter is now available in the Incidents and Alerts queues in the Microsoft Defender portal. This filter lets you filter incidents and alerts based on the sensitivity label assigned to the affected resources. For more information, see Filters in the incident queue and Investigate alerts. (Public Preview) Suggested prompts for incident summaries. Suggested prompts enhance the incident summary experience by automatically surfacing relevant follow-up questions based on the most crucial information in a given incident. With a single click, you can request deeper insight (e.g. device details, identity information, threat intelligence) and obtain plain language summaries from Security Copilot. This intuitive, interactive experience simplifies investigations and speeds up access to critical insights, empowering you to focus on key priorities and accelerate threat response. Microsoft Defender for Endpoint (Public Preview) Multi-tenant endpoint security policies distribution is now in Public Preview. Defender for Endpoint security policies can now be distributed across multiple tenants from the Defender multi-tenant portal. (Public Preview) Custom installation path support for Defender for Endpoint on Linux is available in public preview. (Public Preview) Offline security intelligence update support for Defender for Endpoint on macOS is in public preview. Microsoft Defender for Identity (Public Preview) Entra ID risk level is now available on the Identity Inventory assets page, the identity details page, and in the IdentityInfo table in advanced hunting, and includes the Entra ID risk score. SOC analysts can use this data to correlate risky users with sensitive or highly privileged users, create custom detections based on current or historical user risk, and improve investigation context. (Public Preview) Defender for Identity now includes a new security assessment that helps you identify and remove inactive service accounts in your organization. This assessment lists Active Directory service accounts that have been inactive (stale) for the past 180 days, to help you mitigate security risks associated with unused accounts. For more information, see: Security Assessment: Remove Inactive Service Accounts (Public Preview) A new Graph-based API is now in preview for initiating and managing remediation actions in Defender for Identity. For more information, see Managing response actions through Graph API. (General Availability) Identity scoping is now generally available across all environments. Organizations can now define and refine the scope of Defender for Identity monitoring and gain granular control over which entities and resources are included in security analysis. For more information, see Configure scoped access for Microsoft Defender for Identity. (Public Preview) The new security posture assessment highlights unsecured Active Directory attributes that contain passwords or credential clues and recommends steps to remove them, helping reduce the risk of identity compromise. For more information, see: Security Assessment: Remove discoverable passwords in Active Directory account attributes. Detection update: Suspected Brute Force attack (Kerberos, NTLM). Improved detection logic to include scenarios where accounts were locked during attacks. As a result, the number of triggered alerts might increase. Microsoft Defender for Office 365 SecOps can now dispute Microsoft's verdict on previously submitted email or URLs when they believe the result is incorrect. Disputing an item links back to the original submission and triggers a reevaluation with full context and audit history. Learn more. Microsoft Security Blogs Dissecting PipeMagic: Inside the architecture of a modular backdoor framework A comprehensive technical deep dive on PipeMagic, a highly modular backdoor used by Storm-2460 masquerading as a legitimate open-source ChatGPT Desktop Application. Think before you Click(Fix): Analyzing the ClickFix social engineering technique The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. Storm-0501’s evolving techniques lead to cloud-based ransomware Financially motivated threat actor Storm-0501 has continuously evolved their campaigns to achieve sharpened focus on cloud-based tactics, techniques, and procedures (TTPs).Scope Identity Protection with Defender for Identity is Now Generally Available
I am excited to announce the general availability (GA) of domain-based scoping for Active Directory within Microsoft Defender for Identity. This is a foundational step in extending role-based access control (RBAC) as part of the broader XDR URBAC initiative. This new capability enables SOC analysts to define and refine the scope of Microsoft Defender for Identity monitoring, providing more granular control over which entities and resources are included in security analysis. What is “scoping” and why does it matter? As organizations grow, so does their identity fabric and as security professionals look to manage these increasingly complex identity environments, the ability to control who can access what -and where- is critical. Whether for legal or efficiency reasons many organizations need a way to delegate access based on responsibility or ownership. The new scoping capability is part of Microsoft Defender's unified role-based access control (URBAC) model which allows customers to refine investigation and administration experiences by Active Directory domains, providing: Optimize performance - improve efficiency by focusing analysts on critical assets without the noise of other non-essential alerts and data outside their purview. Enhance visibility control - visibility on specific Active Directory domains. Support operational boundaries - align access and responsibility across SOC analysts, identity admins, and regional teams. This enhancement is part of Microsoft Defender XDR’s unified role-based access control (URBAC) model and sets the foundation for even more granular controls in the future. What can be scoped? Users assigned to scoped roles will only see data, such as alerts, identities, and activities, related to the Active Directory domains included in the assignment in the XDR role. This ensures that security teams can focus on the assets they are responsible for, without being exposed to information from outside their organizational boundaries. Today this includes: Alerts and incidents: Analysts will only see alerts and incidents related to identities within the scoped Active Directory domains within their queue. Entity pages: Users can only access the account details of identities within the Active Directory domains they are scoped for. Advanced hunting and investigations: Data is automatically filtered to include only scoped data. For the full list of supported experiences, see our documentation. How to configure scoping rules: This release is part of our ongoing XDR URBAC effort, bringing consistent and unified role-based access control across Microsoft Defender products. Domain-based scoping is now available for public preview in Microsoft Defender for Identity and aligns with the same RBAC principles used across the XDR platform. To enable the feature, follow these steps: Navigate to XDR permissions page --> Microsoft Defender XDR --> Roles. You can edit existing roles or create a new custom role Add an assignment and create a scoping role with the same set of permissions Define Entra ID user or groups to be assigned to the role Choose Microsoft Defender for Identity as a data source and select User groups (AD domains) that will be scoped to the assignment. Once configured, customers can restrict SOC analysts to viewing only specific entities, ensuring they have access only to the data relevant to their responsibilities and improving security control. Before enabling scoping, ensure that: You have Microsoft Defender for Identity sensor installed. The Identity workload for URBAC is activated. To manage roles without Global Administrator or Security Administrator privileges, customers must configure Authorization permissions through URBAC. Learn more here. What’s next Some experiences are still in progress and will be expanded over time. For setup guidance and more details, visit the Defender for Identity documentation. To stay informed about upcoming enhancements and expanded support for scoping experiences, follow our What’s New documentation page.Hacking Made Easy, Patching Made Optional: A Modern Cyber Tragedy
In today’s cyber threat landscape, the tools and techniques required to compromise enterprise environments are no longer confined to highly skilled adversaries or state-sponsored actors. While artificial intelligence is increasingly being used to enhance the sophistication of attacks, the majority of breaches still rely on simple, publicly accessible tools and well-established social engineering tactics. Another major issue is the persistent failure of enterprises to patch common vulnerabilities in a timely manner—despite the availability of fixes and public warnings. This negligence continues to be a key enabler of large-scale breaches, as demonstrated in several recent incidents. The Rise of AI-Enhanced Attacks Attackers are now leveraging AI to increase the credibility and effectiveness of their campaigns. One notable example is the use of deepfake technology—synthetic media generated using AI—to impersonate individuals in video or voice calls. North Korean threat actors, for instance, have been observed using deepfake videos and AI-generated personas to conduct fraudulent job interviews with HR departments at Western technology companies. These scams are designed to gain insider access to corporate systems or to exfiltrate sensitive intellectual property under the guise of legitimate employment. Social Engineering: Still the Most Effective Entry Point And yet, many recent breaches have begun with classic social engineering techniques. In the cases of Coinbase and Marks & Spencer, attackers impersonated employees through phishing or fraudulent communications. Once they had gathered sufficient personal information, they contacted support desks or mobile carriers, convincingly posing as the victims to request password resets or SIM swaps. This impersonation enabled attackers to bypass authentication controls and gain initial access to sensitive systems, which they then leveraged to escalate privileges and move laterally within the network. Threat groups such as Scattered Spider have demonstrated mastery of these techniques, often combining phishing with SIM swap attacks and MFA bypass to infiltrate telecom and cloud infrastructure. Similarly, Solt Thypoon (formerly DEV-0343), linked to North Korean operations, has used AI-generated personas and deepfake content to conduct fraudulent job interviews—gaining insider access under the guise of legitimate employment. These examples underscore the evolving sophistication of social engineering and the need for robust identity verification protocols. Built for Defense, Used for Breach Despite the emergence of AI-driven threats, many of the most successful attacks continue to rely on simple, freely available tools that require minimal technical expertise. These tools are widely used by security professionals for legitimate purposes such as penetration testing, red teaming, and vulnerability assessments. However, they are also routinely abused by attackers to compromise systems Case studies for tools like Nmap, Metasploit, Mimikatz, BloodHound, Cobalt Strike, etc. The dual-use nature of these tools underscores the importance of not only detecting their presence but also understanding the context in which they are being used. From CVE to Compromise While social engineering remains a common entry point, many breaches are ultimately enabled by known vulnerabilities that remain unpatched for extended periods. For example, the MOVEit Transfer vulnerability (CVE-2023-34362) was exploited by the Cl0p ransomware group to compromise hundreds of organizations, despite a patch being available. Similarly, the OpenMetadata vulnerability (CVE-2024-28255, CVE-2024-28847) allowed attackers to gain access to Kubernetes workloads and leverage them for cryptomining activity days after a fix had been issued. Advanced persistent threat groups such as APT29 (also known as Cozy Bear) have historically exploited unpatched systems to maintain long-term access and conduct stealthy operations. Their use of credential harvesting tools like Mimikatz and lateral movement frameworks such as Cobalt Strike highlights the critical importance of timely patch management—not just for ransomware defense, but also for countering nation-state actors. Recommendations To reduce the risk of enterprise breaches stemming from tool misuse, social engineering, and unpatched vulnerabilities, organizations should adopt the following practices: 1. Patch Promptly and Systematically Ensure that software updates and security patches are applied in a timely and consistent manner. This involves automating patch management processes to reduce human error and delay, while prioritizing vulnerabilities based on their exploitability and exposure. Microsoft Intune can be used to enforce update policies across devices, while Windows Autopatch simplifies the deployment of updates for Windows and Microsoft 365 applications. To identify and rank vulnerabilities, Microsoft Defender Vulnerability Management offers risk-based insights that help focus remediation efforts where they matter most. 2. Implement Multi-Factor Authentication (MFA) To mitigate credential-based attacks, MFA should be enforced across all user accounts. Conditional access policies should be configured to adapt authentication requirements based on contextual risk factors such as user behavior, device health, and location. Microsoft Entra Conditional Access allows for dynamic policy enforcement, while Microsoft Entra ID Protection identifies and responds to risky sign-ins. Organizations should also adopt phishing-resistant MFA methods, including FIDO2 security keys and certificate-based authentication, to further reduce exposure. 3. Identity Protection Access Reviews and Least Privilege Enforcement Conducting regular access reviews ensures that users retain only the permissions necessary for their roles. Applying least privilege principles and adopting Microsoft Zero Trust Architecture limits the potential for lateral movement in the event of a compromise. Microsoft Entra Access Reviews automates these processes, while Privileged Identity Management (PIM) provides just-in-time access and approval workflows for elevated roles. Just-in-Time Access and Risk-Based Controls Standing privileges should be minimized to reduce the attack surface. Risk-based conditional access policies can block high-risk sign-ins and enforce additional verification steps. Microsoft Entra ID Protection identifies risky behaviors and applies automated controls, while Conditional Access ensures access decisions are based on real-time risk assessments to block or challenge high-risk authentication attempts. Password Hygiene and Secure Authentication Promoting strong password practices and transitioning to passwordless authentication enhances security and user experience. Microsoft Authenticator supports multi-factor and passwordless sign-ins, while Windows Hello for Business enables biometric authentication using secure hardware-backed credentials. 4. Deploy SIEM and XDR for Detection and Response A robust detection and response capability is vital for identifying and mitigating threats across endpoints, identities, and cloud environments. Microsoft Sentinel serves as a cloud-native SIEM that aggregates and analyses security data, while Microsoft Defender XDR integrates signals from multiple sources to provide a unified view of threats and automate response actions. 5. Map and Harden Attack Paths Organizations should regularly assess their environments for attack paths such as privilege escalation and lateral movement. Tools like Microsoft Defender for Identity help uncover Lateral Movement Paths, while Microsoft Identity Threat Detection and Response (ITDR) integrates identity signals with threat intelligence to automate response. These capabilities are accessible via the Microsoft Defender portal, which includes an attack path analysis feature for prioritizing multicloud risks. 6. Stay Current with Threat Actor TTPs Monitor the evolving tactics, techniques, and procedures (TTPs) employed by sophisticated threat actors. Understanding these behaviours enables organizations to anticipate attacks and strengthen defenses proactively. Microsoft Defender Threat Intelligence provides detailed profiles of threat actors and maps their activities to the MITRE ATT&CK framework. Complementing this, Microsoft Sentinel allows security teams to hunt for these TTPs across enterprise telemetry and correlate signals to detect emerging threats. 7. Build Organizational Awareness Organizations should train staff to identify phishing, impersonation, and deepfake threats. Simulated attacks help improve response readiness and reduce human error. Use Attack Simulation Training, in Microsoft Defender for Office 365 to run realistic phishing scenarios and assess user vulnerability. Additionally, educate users about consent phishing, where attackers trick individuals into granting access to malicious apps. Conclusion The democratization of offensive security tooling, combined with the persistent failure to patch known vulnerabilities, has significantly lowered the barrier to entry for cyber attackers. Organizations must recognize that the tools used against them are often the same ones available to their own security teams. The key to resilience lies not in avoiding these tools, but in mastering them—using them to simulate attacks, identify weaknesses, and build a proactive defense. Cybersecurity is no longer a matter of if, but when. The question is: will you detect the attacker before they achieve their objective? Will you be able to stop them before reaching your most sensitive data? Additional read: Gartner Predicts 30% of Enterprises Will Consider Identity Verification and Authentication Solutions Unreliable in Isolation Due to AI-Generated Deepfakes by 2026 Cyber security breaches survey 2025 - GOV.UK Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations | Microsoft Security Blog MOVEit Transfer vulnerability Solt Thypoon Scattered Spider SIM swaps Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters | Microsoft Security Blog Microsoft Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn Zero Trust Architecture | NIST tactics, techniques, and procedures (TTP) - Glossary | CSRC https://learn.microsoft.com/en-us/security/zero-trust/deploy/overviewDeep Dive: DLP Incidents, Alerts & Events - Part 2
Alerts Overview Like the Incidents, alerts also provide comprehensive information such as severity, status, category etc. to help users understand and navigate efficiently. In addition to these standard details, the alert view also displays the correlation reason, which is particularly beneficial for security analysts and administrators. The correlation reason explains why an alert is linked to a particular incident or other alerts, helping users trace how different pieces of suspicious activity are connected. By understanding the correlation reason, users can better assess the scope and impact of security issues, streamline investigations, and take more effective remediation actions, ultimately improving the overall security posture of the organisation Alert Details The details page is divided into two sections. The section on the left presents information regarding Impacted Users and Devices (for Endpoints), including details such as the alert story, policy description, matched sensitive information, and its count. It also displays related events with detection time and location (such as Exchange or Endpoint). The right pane lets you view alert status, details, manage the alert, or move it to another incident. It shows evidence (entity details like IP, user, device), policy info, incident details, correlation reasons, plus alert comments, history, and a timeline. Event Details Now that we understand incidents and alerts, let's review events. Events offer detailed information about activity. Below is a brief description of each section for reference. Details Event Details Event ID: A unique identifier assigned to each event. It can be used to associate the event with corresponding DLP rule match activity within the Activity Explorer. Location: Specifies where the activity occurred, such as Exchange, Devices, etc. Time of Activity: Indicates the exact time at which the event took place. Impacted Entities: Hostname: The name of the device where the DLP event occurred. IP Address: The IP address of the device or client involved in the event. Application: The app or service used during the event (e.g., Edge, Outlook, Teams). File Name: The name of the file involved in the DLP violation. File Path: The full directory path where the file was located or accessed. File Extension: The file type suffix (e.g., .docx, .pdf) indicating format. Sha1: A SHA-1 hash value used to uniquely identify the file. Sha256: A SHA-256 hash value offering stronger file identification. File Type: The type of the file (e.g., document, spreadsheet, image). File Size: The size of the file in bytes or megabytes. RMS Encrypted: Indicates whether the file is protected using Rights Management Services. MDATP Device ID: A unique identifier for the device from Microsoft Defender for Endpoint. Client Country: The geographic location of the client device based on IP. Client IP Location: More granular geolocation data derived from the client IP address. Target Domain: The destination domain involved in the data transfer (e.g., external email or cloud service). Evidence File: A copy or reference to the file that triggered the DLP event, used for investigation. Hunt & Monitor: Hunt All Sensitive Content Activity by Device: Displays all sensitive data interactions per device, useful for device-level threat hunting. Activity by User: Shows user-specific actions involving sensitive content, helping identify insider risks. DLP Violations for Last 30 Days: Summarizes all DLP policy violations over the past month for trend analysis and compliance tracking. User & Role Info: Displays the user detail and the role assigned to the user. Policy Details: DLP Policy Matched: The specific DLP policy that was triggered by the event, based on organizational data protection rules. Rule Matched: The exact rule within the DLP policy that was violated (e.g., sharing sensitive data externally). Sensitive Info Types Detected: Lists predefined or custom sensitive information types (e.g., credit card numbers, health records) found in the content. You can click on the SIT to view more information such as count by confidence levels, matched content and surrounding text. Trainable Classifiers Detected: Lists AI-based classifiers that identify sensitive content based on context and user behavior (e.g., source code, resumes). Violating Action: The user action that caused the violation (e.g., copy to USB, email to external domain, print, upload to cloud). Enforcement Mode: Indicates whether the policy is in audit, block/warn, override/warn & bypass mode—defining how the system responds to violations. Override Justification Text: If a user overrides a policy block, this field captures their justification or reason. Sensitive Information Type: A more detailed view of the specific sensitive data detected (e.g., “India Aadhaar Number”, “EU Passport Number”). Source This tab enables users to preview content intended for exfiltration, including files or emails. The Actions tab allows authorised users to download the specified content. Note: Previewing or downloading content requires that the administrator or analyst possesses the appropriate role permissions. Sensitive Info Types Lists predefined or custom sensitive information types found in the content with matched content and surrounding text info. Trainable Classifiers Lists Trainable Classifiers and their details. Metadata Provides the detailed metadata in simple txt format. Hope this helps!
