Check out this detailed guidance for investigating and remediating common attack methods that attackers employ every day:
- Phishing
- Password spray
- App consent grant
Each playbook includes:
- Prerequisites: The specific requirements you need to complete before starting the investigation. For example, logging that should be turned on and roles and permissions that are required.
- Workflow: The logical flow that you should follow to perform the investigation.
- Checklist: A list of tasks for the steps in the flow chart. This checklist can be helpful in highly regulated environments to verify what you have done.
- Investigation steps: Detailed step-by-step guidance for the specific investigation.
Review the content here:
- RELEASE: Incident Response Playbooks for Phishing, Password Spray
https://aka.ms/IRPlaybooks
kurtsh
Kurt Shintaku's Blog 