Tag

#Incident Response

2 articles covering Incident Response across campaign analysis, detection engineering, and defender tradecraft.

Coverage

2 entries

Field Analysis

Dual UseTradecraft LabsJun 7, 202611 min read

The Step After the Click: Five Persistence Primitives That Survive Your Response

Mailbox rules, OAuth grants, replayed sessions, RMM agents, and downstream account changes are not the aftermath of an intrusion — they are the point. A field guide to the persistence layer most response playbooks still treat as cleanup.

From User Report to Token Revocation: A 60-Minute M365 Phishing Response Walkthrough

Most M365 phishing incidents are decided in the first hour. This walkthrough lays out a 60-minute response chain from user report to refresh-token revocation and consent reversal.

By PhishPond Desk

#Incident Response
#Entra ID
#Token Theft

#Incident Response

Coverage

Browse Other Tags