Detection and protection success stories Insights

August 26 23 min read

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.
August 4 7 min read

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread.
June 4 6 min read

Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us

A surge in real-world attacks against agentic AI systems is reshaping how we think about risk.
May 22 11 min read

From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence

A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity compromise.
Retain Microsoft Defender Experts

Microsoft Defender Experts are available to strengthen your teams with expertise when and where you need it. Learn how to elevate your security with expert-led services.

Get started
May 12 9 min read

Accelerating detection engineering using AI-assisted synthetic attack logs generation

What if you could generate realistic attack telemetry on demand? Explore research methods that translate attacker behaviors (TTPs) into synthetic logs that can trigger detections at scale and without sensitive data.
April 28 13 min read

Simplifying AWS defense with Microsoft Sentinel UEBA

Learn how Microsoft Sentinel UEBA helps defenders distinguish benign AWS activity from attacker behavior by enriching raw CloudTrail logs with clear, binary behavioral signals derived from baseline user, peer, and device behavior patterns.
April 17 8 min read

Containing a domain compromise: How predictive shielding shut down lateral movement

Domain compromise accelerates fast. Predictive shielding slowed it down.
March 27 7 min read

How Microsoft Defender protects high-value assets in real-world attack scenarios

High-value assets including domain controllers, web servers, and identity infrastructure are frequent targets in sophisticated attacks.
Modernize your Security Operations Center with Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM solution powered by AI and automation that delivers intelligent security analytics across your entire enterprise.

Learn more
March 23 7 min read

Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started

Microsoft Defender stopped a human-operated ransomware attack that abused Group Policy Objects (GPOs) to disable defenses and push encryption at scale.
January 30 4 min read

Case study: Securing AI application supply chains

Securing AI-powered applications requires more than just safeguarding prompts.
January 29 6 min read

Turning threat reports into detection insights with AI

Security teams often spend days manually turning long incident reports and threat writeups into actionable detections by extracting TTPs.

Detection and protection success stories

Filtered by

Refine results

When AI infrastructure becomes the target: Securing gateways and control points

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us

From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence

Accelerating detection engineering using AI-assisted synthetic attack logs generation

Simplifying AWS defense with Microsoft Sentinel UEBA

Containing a domain compromise: How predictive shielding shut down lateral movement

How Microsoft Defender protects high-value assets in real-world attack scenarios

Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started

Case study: Securing AI application supply chains

Turning threat reports into detection insights with AI

Get started with Microsoft Security

Detection and protection success stories

Filtered by

Refine results

Retain Microsoft Defender Experts

Modernize your Security Operations Center with Microsoft Sentinel

Get started with Microsoft Security