Advanced Incident Response in the Microsoft cloud - Korstiaan Stam (Invictus Incident Response) - DCTSG2027
Description
Name of Training: Advanced Incident Response in the Microsoft cloud
Trainer(s): Korstiaan Stam (Invictus Incident Response)
Skill Level: Intermediate, Advanced
Dates: March 5 – March 6, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3,600 (incl. GST)
Short Summary
Every attack in Azure and Microsoft 365 leaves evidence behind. This hands-on course teaches you where to find it, how to acquire it and how to turn it into a clear account of what happened. Over two days you investigate the techniques seen in real incidents, from AiTM phishing and token theft to persistence through applications and federation, as well as the new attack surface created by Copilot and AI agents. You finish by reconstructing two full intrusions in a Capture The Flag, one in Azure and one in Microsoft 365, and leave able to independently scope and run a cloud incident response engagement in the Microsoft Cloud.
Course Description
This two-day training is a practical guide to incident response in the Microsoft Cloud.
Day one covers Azure and Entra ID. You learn which services and log sources matter for IR, how tenants are configured in real client environments, and how to use KQL and the Graph API in an investigation. The rest of the day follows the attack lifecycle (reconnaissance, initial access, execution, privilege escalation, persistence, credential access and exfiltration), always from the perspective of what evidence each technique leaves behind.
Day two shifts to Microsoft 365. It starts with a deep dive into the Unified Audit Log, followed by mailbox and transport rules, the Mailbox Audit Log, Message Trace and the Graph Activity Logs. You then investigate the attacks most commonly seen in M365 environments and the anti-forensic techniques attackers use to hide them. A dedicated module covers AI in the Microsoft Cloud from both sides: how Copilot and agent activity shows up in the audit trail and how attackers abuse it, and where AI assistance can help responders and where it introduces evidential risk.
Both days close with remediation and recovery guidance you can hand straight to a client.
All material is based on real-life incidents and on evidence generated by executing the attacks ourselves. A large share of the class is hands-on: participants work through nine labs in a pre-configured Microsoft lab environment and finish with a Capture The Flag covering two full attack scenarios, one in Azure and one in M365, where the task is to reconstruct as much of the intrusion as possible. The instructor works cloud incident response cases for a living and develops open-source tooling used across the industry, including the Microsoft-Extractor-Suite, so the material includes detail that is not documented publicly.
Course Outline
View full outline
Hide outline
Day 1 - Morning: Azure and Entra ID foundations for incident response
- Azure IR introduction: services in Azure relevant to IR, how Azure tenants are configured in client environments
- Entra ID for incident response: user types (member vs guest), security principals (users, groups, service principals, managed identities), Entra ID roles vs Azure roles, hybrid setups including PHS, PTA and ADFS
- Entra ID and Azure audit and logging: tenant logging (sign-in, audit, provisioning), subscription logging (activity log), resource logging (compute, storage, network), routing logs into a Log Analytics workspace and how to export each
- KQL for incident response: introduction, need-to-know commands, advanced KQL, working with the log schemas in Log Analytics
- Lab 1.1: KQL basics, run in a live Log Analytics workspace
- Lab 1.2: Exploring OAuth apps, identifying consented applications, permissions and attacker-registered apps
Day 1 - Afternoon: Azure attack techniques and response
- Graph API for incident response: Graph Explorer, application setup with a certificate, Graph API calls for IR, Graph Activity Logs
- Azure attack techniques part I: ATT&CK overview, internal and external reconnaissance, initial access, Identity Protection and risk detections
- Lab 1.3: Risky sign-ins, triaging risk detections and reconstructing an initial access attempt from sign-in telemetry
- Azure attack techniques part II: execution (RunCommand, VM scripting, automation accounts, function apps, Cloud Shell, Serial Console), privilege escalation (PIM, elevated access toggle, Entra ID applications), persistence (account creation, NSG modification, Azure Lighthouse and delegated administrators, cross-tenant synchronisation, subscription transfers, federation)
- Lab 1.4: Investigating execution, persistence and privilege escalation attacks
- Azure attack techniques part III: credential access (tokens, application secrets, Key Vault dumping) and exfiltration (snapshots, disk sharing, SAS abuse)
- Lab 1.5: Investigating credential access and exfiltration attacks
- Responding to Azure attacks: prepare, contain and remediate, recover, token and session revocation, plus Azure IR tooling
Day 2 - Morning: Microsoft 365 forensic artefacts
- Microsoft 365 IR introduction and overview of available artefacts
- The Unified Audit Log: overview, premium audit options, UAL structure, acquisition methods
- Lab 2.1: Exploration of the UAL
- Other M365 forensic artefacts: forward rules and transport rules, Mailbox Audit Log, Message Trace log, Graph Activity Logs
- Microsoft 365 initial access: phishing, MitM and AiTM attacks
- Lab 2.2: Adversary-in-the-middle, investigating an AiTM phishing attack end to end
Day 2 - Afternoon: Microsoft 365 attacks, AI abuse, remediation and CTF
- Microsoft 365 attack techniques: token theft and session hijacking, execution (API calls and PowerShell), persistence and privilege escalation (account manipulation, account creation, MFA registration), collection and exfiltration (eDiscovery and content search, Power Automate abuse)
- Lab 2.3: Investigation of token abuse, identifying stolen token use and distinguishing it from legitimate activity
- Investigating AI abuse in the Microsoft Cloud: what Copilot and agent activity looks like in the audit trail, agent and app identities as an attack surface, data access and exfiltration through AI features, and the forensic gaps you should expect
- Anti-forensics: UAL retention policy abuse, removing security alerts, purging phishing email, disabling mailbox audit logging
- M365 IR tooling and AI for cloud incident response: Microsoft-Extractor-Suite, Hawk, Defender for Cloud Apps, and where AI assistance helps in triage, log summarisation and query generation, including its limits and the evidential risks
- Lab 2.4: The Extractor Suite, acquiring evidence from a live M365 tenant
- Remediation and recovery best practices: credential reset, MFA deployment, removing attacker-set MFA, email forwarding, active sessions, delegated access, legacy authentication, connectors, phishing email and OAuth applications
- Capture The Flag: full attack scenarios in Azure and Microsoft 365, wrap-up and evaluation
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.
Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.
Suggested Prerequisites
Students should be comfortable as day-to-day users or administrators of the Microsoft Cloud. Specifically:
- Working familiarity with Entra ID and Microsoft 365 concepts: tenants, subscriptions, users and guests, groups, roles, service principals and applications. You do not need to be an architect, but you should know what these are.
- KQL: no prior experience required. The course includes a dedicated KQL section and lab that starts from the basics, but students who have written KQL before will move faster through day one.
- General incident response fundamentals: the attack lifecycle, what scoping means, and basic log analysis. The ideal student has around three years of practical experience in IR, SOC, threat hunting or digital forensics.
- Traditional host or network forensics experience is welcome but not required. This course does not assume any prior cloud forensics knowledge.
What Students Should Bring
- A laptop running Windows, macOS or Linux, with local admin rights to install PowerShell modules
- PowerShell 7, installed before the course
- A modern web browser
- Please note: employer-managed laptops sometimes block sign-in to external Microsoft tenants (for example through Tenant Restrictions or a corporate proxy). If your laptop is managed by your employer, consider bringing a personal or unmanaged device.
What the Trainer Will Provide
- Slides and digital course materials
- Cheat sheets for KQL and Microsoft Cloud incident response
- Access to a pre-configured Microsoft lab environment and the CTF platform during the course
- A certificate of completion
Trainer(s) Bio
Korstiaan is a cloud incident response specialist with over a decade of experience investigating intrusions for large enterprises and consulting firms, most of that time focused on the cloud. He is the founder of Invictus Incident Response, an independent IR firm working cases across Microsoft 365, Azure, AWS and Google Workspace, and a former SANS instructor for FOR509: Enterprise Cloud Forensics and Incident Response.
He is also the author and maintainer of several open-source cloud IR tools used widely in the DFIR community:
- Microsoft-Extractor-Suite, for Microsoft Azure and M365 evidence acquisition
- Invictus-AWS, a toolset for AWS incident response engagements
- ALFA, for acquiring and analysing Google Workspace logging
Besides teaching for SANS, he has delivered cloud incident response training at DEF CON and Black Hat for the past five years, at events across the US, Europe and Asia.
Proficiency Exam
The course ends with a Capture The Flag covering two full attack scenarios. Participants who complete all labs and correctly answer at least 60% of the CTF questions receive a certificate of completion.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
