Use Case: Investigate an Incident and Associated Suspicious Entities

 

Scenario

Security Analysts are usually assigned the responsibility of looking into alerts and obtaining relevant information related to an incident. To ascertain the possible impact on the organization, they correlate data from various sources and perform root cause analyses.

According to the situation analysts might have to look at malware, reverse engineer files or scripts, analyze logs, and look into URLs they saw. Knowing what remediation actions to take and how to communicate important findings to stakeholders in order to keep them updated on the incident's current status are crucial aspects of an investigation. 

Steps:

• Start investigating in Microsoft Defender XDR.
• Analyze the suspicious script.
• Extend the investigation in Security Copilot via natural language prompts and more plugins.
• To gain a more comprehensive understanding of the incident, use Security Copilot to gather more information about suspicious activity seen in the command line script. 

Prompt used: 

What can you tell me about the reputation of the indicators in the scripts? Are they malicious? If so, why?

• Use Security Copilot to provide an assessment of the incident with supporting evidence and a set of recommendations. 

Prompt used:

Summarize the findings from the investigation and conclude with a set of recommendations.

Conclusion

In this use case Security Copilot assisted in carrying out a comprehensive incident investigation. Analysts can confirm that indicators in the suspicious script are linked to known threat actors and obtain an explanation of the script's actions using natural language. Furthermore, Security Copilot produced an evaluation in the form of a summary report and offered a series of suggestions for containing the incident, which can also be utilized to improve proficiency.