How SOC ANALYST investigate post exploitation using Microsoft Defender

What happens after an attacker successfully compromises a Microsoft 365 account through Device Code Phishing?

In this video, I walk through a realistic investigation scenario and demonstrate how Microsoft Graph Activity Logs can reveal exactly what an attacker did after gaining access to a user's account.

You'll learn how to:

Investigate Post exploitation attack
Identify reconnaissance actions performed by attackers
Detect newly invited guest accounts used as persistence mechanisms
Find evidence of backdoor account creation
Track attacker activity through Microsoft Graph API operations
Correlate findings with Microsoft Sentinel and other Microsoft security logs
Understand where to look during a Microsoft 365 incident response investigation

Using real-world attack techniques and SOC investigation methods, I'll show how security analysts can leverage Microsoft Graph Activity Logs to uncover attacker behavior that may not be visible in traditional sign-in logs.

Видео How SOC ANALYST investigate post exploitation using Microsoft Defender канала Cyber Guardians