🧰 Microsoft Security Copilot

The items that name it 11

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeup2026-10-31

  Helps investigate and respond to incidents and hunt for threats in Microsoft Defender.

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeup2026-10-30

  Helps analysts summarize the Teams-to-remote-access sequence, correlate certificate alerts with identities and prepare containment tasks.

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeup2026-10-21It is written here as Microsoft Security Copilot: promptbooks for incident investigation, threat actor profile, and Threat Intelligence 360 report.
• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  article2026-10-14It is written here as Microsoft Security Copilot: agents include Threat Intelligence Briefing, Phishing Triage, Threat Hunting and Dynamic Threat Detection.
• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeup2026-09-30

  AI-powered incident summarization, file/script analysis, identity summaries, guided responses, hunting query generation, and incident reports; usable via promptbooks for incident investigation, script/file analysis, device summaries, and vulnerability impact assessment related to CVE-2026-73570.

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeup2026-09-29

  AI-powered incident summarization, file/script analysis, hunting query generation, incident reports; includes Threat Intelligence Briefing, Phishing Triage, Threat Hunting, and Dynamic Threat Detection agents

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeup2026-09-28

  AI-powered capability embedded in Defender for summarizing incidents, analyzing files/scripts, identities, guided responses, hunting queries, incident reports; includes Threat Intelligence Briefing, Phishing Triage, Threat Hunting, and Dynamic Threat Detection agents

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeup2026-09-25

  Investigate and respond to incidents, hunt for threats, and use prebuilt promptbooks (Incident investigation, Microsoft User analysis, Threat actor profile, Threat Intelligence 360 report) related to this threat

• Passkey-themed social engineering leads to identity and cloud compromise
  writeup2026-09-09

  Investigate and respond to incidents, hunt for threats, and use prebuilt promptbooks (Incident investigation, Microsoft User analysis) for this intrusion pattern.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  article2026-08-26

  Used via standalone experience/promptbooks to correlate gateway, credential-access, mining, and persistence signals into a timeline and assess exposed accounts/service principals

• AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
  writeup2026-06-19

  Summarizes incidents, generates KQL, triages alerts