How to Investigate Security Incidents in Microsoft Defender for Endpoint

Effective incident investigation is critical for understanding the scope of an attack, containing threats, and preventing recurrence. Microsoft Defender for Endpoint provides powerful investigation tools including incident correlation, device timelines, and advanced hunting. This guide walks through the complete incident investigation workflow.

Prerequisites

Before investigating incidents, ensure you have:

• Security Reader role (minimum) or Security Operator role (for taking actions)
• Familiarity with common attack techniques (MITRE ATT&CK framework)
• Access to the Microsoft Defender portal
• Understanding of your organization's critical assets and normal behavior

Understanding the Investigation Workflow

Alert Triggered → Incident Created → Triage → Investigation → Containment → Remediation → Post-Incident Review

Each phase has specific objectives:

Step 1: Access the Incident Queue

1. Sign in to the Microsoft Defender portal
2. Navigate to Incidents & alerts > Incidents
3. Review the incident queue showing:
   • Incident name and ID
   • Severity level
   • Status (New, In Progress, Resolved)
   • Affected devices and users
   • Alert count

Filter Incidents Effectively

Use filters to focus on priority items:

• Severity: High, Medium, Low, Informational
• Status: New (unassigned), In Progress (being investigated)
• Assigned to: Filter by analyst or unassigned
• Device group: Critical servers, executive devices, etc.
• Service source: Defender for Endpoint, Defender for Identity, etc.

Step 2: Perform Initial Triage

Assess the Incident

Click on an incident to open the incident page:

1. Review the incident summary:

   • Attack story visualization
   • Affected entities (devices, users, mailboxes)
   • Related alerts with timestamps

2. Check incident classification:

   • True Positive: Confirmed malicious activity
   • False Positive: Benign activity incorrectly flagged
   • Informational: Expected activity, awareness only

3. Evaluate business impact:

   • Is the affected device critical?
   • Is the user privileged (admin, executive)?
   • Are sensitive systems or data at risk?

Quick Triage Checklist

Before deep investigation, verify:

• Is this a known false positive pattern?
• Is the affected device in scope (managed, production)?
• Are there related incidents to correlate?
• What is the latest alert timestamp (ongoing vs. historical)?

Assign and Update Status

1. Click Manage incident
2. Set Status to "In Progress"
3. Assign to yourself or team member
4. Add Tags for categorization (e.g., "Ransomware", "Phishing")
5. Adjust Classification if initial assessment differs

Step 3: Analyze the Attack Story

Understanding the Attack Graph

The Attack story tab shows a visual timeline:

• Nodes: Entities (devices, users, files, processes)
• Edges: Relationships and actions between entities
• Timeline: Chronological sequence of events

Look for:

• Initial access point (how did the attack start?)
• Lateral movement (did it spread to other devices?)
• Actions on objectives (data exfiltration, encryption?)

Review Related Alerts

Each incident contains correlated alerts:

1. Click the Alerts tab

2. Review each alert's:

   • Detection source: AV, EDR, cloud, network
   • MITRE ATT&CK technique: Mapped attack tactic
   • Evidence: Files, processes, network connections

3. Click into individual alerts for detailed evidence

Step 4: Investigate the Device Timeline

The device timeline is your primary investigation tool.

Access the Timeline

1. From the incident, click on an affected Device
2. Select the Timeline tab
3. Filter by time range around the incident

Timeline Event Types

Key Investigation Queries

Look for these suspicious patterns:

Suspicious Process Trees:

1. Parent: outlook.exe
   └── Child: cmd.exe
       └── Child: powershell.exe -enc [Base64]

This indicates a phishing email spawning malicious scripts.

Unusual Network Connections:

• Connections to rare destinations
• Large data transfers outbound
• Connections on non-standard ports
• Beaconing patterns (regular interval connections)

Persistence Mechanisms:

• Registry Run key modifications
• Scheduled task creation
• Service installation
• Startup folder additions

Use Advanced Filters

1. Click Filters on the timeline
2. Select specific event types:
   • Process create for execution analysis
   • File create for dropped files
   • Network connections for C2 communication
3. Search for specific filenames, hashes, or IPs

Step 5: Perform Advanced Hunting

Use KQL queries for deeper investigation.

Access Advanced Hunting

1. Go to Hunting > Advanced hunting
2. Use pre-built queries or write custom ones
3. Time range defaults to 30 days

Common Investigation Queries

Find all processes from a suspicious parent:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

Check for lateral movement:

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DeviceName == "affected-device"
| where RemotePort in (445, 135, 5985, 3389)
| summarize ConnectionCount = count() by RemoteIP, RemotePort
| order by ConnectionCount desc

Find file modifications by hash:

DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 == "suspicious-file-hash-here"
| project Timestamp, DeviceName, FileName, FolderPath, ActionType

Identify persistence:

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey contains "Run" or RegistryKey contains "RunOnce"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData

Step 6: Contain the Threat

Take immediate action to stop active threats.

Isolate the Device

Network isolation prevents lateral movement while maintaining Defender connectivity:

1. On the device page, click ... menu
2. Select Isolate device
3. Choose isolation type:
   • Full isolation: Block all network (except Defender)
   • Selective isolation: Allow specific apps
4. Add a comment and confirm
5. Release isolation after remediation

Block Indicators

Add malicious indicators to block across all devices:

1. Go to Settings > Endpoints > Indicators
2. Click Add indicator
3. Add:
   • File hashes: SHA256, SHA1, MD5
   • IP addresses: C2 servers
   • URLs/Domains: Malicious sites
4. Set action: Block and remediate
5. Add indicator context and confirm

Stop and Quarantine

For active malware:

1. On the device page, use Live Response or
2. From an alert, click Stop and quarantine file
3. Verify file is quarantined in timeline

Step 7: Remediate

Remove all threat artifacts from affected systems.

Automated Remediation

If enabled, Automated Investigation and Remediation (AIR) handles:

1. View Investigation tab on the incident
2. Review automated actions taken:
   • Files quarantined
   • Processes stopped
   • Persistence removed
3. Approve pending actions if in semi-automatic mode

Manual Remediation Checklist

• Quarantine malicious files
• Stop malicious processes
• Remove persistence mechanisms
• Reset compromised credentials
• Patch exploited vulnerabilities
• Clear browser cached credentials
• Review and restore modified system files

Using Live Response

For hands-on remediation:

1. Start a Live Response session
2. Run remediation commands:

# Remove malicious file
Remove-Item -Path "C:\Malware\badfile.exe" -Force

# Stop malicious process
Stop-Process -Name "malicious" -Force

# Remove registry persistence
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MalwareKey"

# Remove scheduled task
Unregister-ScheduledTask -TaskName "MaliciousTask" -Confirm:$false

Step 8: Document and Close

Complete Incident Documentation

1. Click Manage incident
2. Set Classification:
   • True Positive: Confirmed threat
   • False Positive: Benign, update detection
   • Informational: Expected activity
3. Set Determination:
   • Malware, Phishing, Unwanted software, etc.
4. Add detailed Comments documenting:
   • Investigation findings
   • Root cause
   • Actions taken
   • Recommendations
5. Change Status to "Resolved"

Post-Incident Actions

• Update detection rules to prevent recurrence
• Add new indicators to blocklists
• Document lessons learned
• Brief stakeholders if significant
• Schedule follow-up vulnerability remediation

Best Practices

Investigation Tips

1. Start with high-confidence alerts: Focus on clearly malicious activity first
2. Work backwards: Start from the alert and trace to initial access
3. Document everything: Notes help when revisiting or handing off
4. Use multiple data sources: Correlate Defender data with SIEM, network logs
5. Know your environment: Understand what's normal to spot anomalies

Common Mistakes to Avoid

• Isolating devices before collecting volatile evidence
• Jumping to remediation without understanding full scope
• Closing incidents without confirming remediation success
• Ignoring low-severity alerts that may be part of larger campaign

Investigation Playbooks by Alert Type

Suspicious PowerShell

1. Check command line for encoded content
2. Decode Base64 if present
3. Trace parent process to find initial access
4. Look for dropped files or network connections
5. Check for persistence created

Credential Dumping

1. Identify the tool used (mimikatz, etc.)
2. Determine compromised accounts
3. Check for lateral movement using stolen creds
4. Force password reset for affected accounts
5. Enable additional MFA protections

Ransomware

1. Immediately isolate affected devices
2. Identify ransomware variant and encryption scope
3. Check for data exfiltration before encryption
4. Block C2 infrastructure across environment
5. Assess backup integrity and recovery options

Next Steps

After mastering investigations:

• Configure Attack Surface Reduction rules to prevent attacks
• Learn Microsoft Sentinel for advanced SIEM correlation
• Develop custom detection rules for your environment
• Build automated playbooks for common incident types

Need expert incident response support? Inventive HQ provides 24/7 incident response services and security operations center capabilities. Contact us for rapid response when threats strike.