Investigate Ransomware in Defender

Triage a simulated ransomware incident and write an evidence-backed escalation.

Introduction

30 Second Summary

A red warning can make a security situation feel certain before anyone has checked the facts. Good decisions start with tracing what happened and recording what the evidence supports.

In this project, you will investigate a simulated ransomware incident in the Microsoft Defender portal simulation. You will turn the evidence into a saved SOC incident report with a verdict and an escalation recommendation.

What You'll Build

You will open your completed incident report and explain how the evidence led from a high-severity queue item to a supported verdict.

By the end of this project, you'll have:

A filtered incident queue that isolates the relevant ransomware case for investigation.
An evidence-backed attack timeline reconstructed from alerts, the 10.50.0.16 IP entity, and a process tree.
A resolved incident supported by a saved report that records affected entities, evidence verdicts, remediation status, confidence, and next actions.
Secret Mission: Audit the Copilot-generated summary against raw evidence. Flag one claim that still needs analyst verification.

Are there any prerequisites?

You need a Windows computer with internet access. Basic networking and security knowledge will help you interpret the evidence.

The exercise runs in a free Microsoft Learn simulation, so you do not need a paid security platform or an Azure subscription.

Before We Start

Before the investigation begins, this checkpoint locks in the question your evidence needs to answer. Your goal is to determine what happened, what was affected, and what should happen next.

Set Up Your Investigation Workspace

A reliable SOC investigation depends on capturing evidence while it is still on screen. Keeping the Microsoft Defender portal simulation beside your analyst notes gives each finding a place to land.

This step opens the free Microsoft Learn exercise in Microsoft Edge. You will create a plain-text incident report in Notepad beside it.

In this step, get ready to:

Open the Microsoft Defender simulation on the Defender portal path.
Place Notepad beside the simulation for evidence capture.
Save the incident report template as SOC-Incident-Report.txt.

Open the Defender simulation

The Defender path gives you a scripted incident with the evidence views used throughout this project. Keeping the exercise page open separately makes it easy to return to the verified investigation path.

Press the Windows key to open search.
Type Microsoft Edge into the search box.
Press Enter to open Microsoft Edge.
Open the Microsoft Learn incident-investigation exercise.
Scroll to the Defender portal section.
Select the Microsoft Defender portal link.
Drag the simulation tab away from the tab bar if it opens inside the exercise window.
Continue in the separate Defender simulation window.

You should see the Microsoft Defender incident environment in its own Edge window. The original Edge window should still show the Microsoft Learn exercise.

Your evidence environment is ready for the investigation.

Why Use the Defender Simulation?

Microsoft Learn provides this training at no cost. The simulation gives you a scripted Defender incident without an Azure subscription.

The simulation follows a fixed script. Controls outside that path may show This feature isn't available within the simulation.

Simulation Not Opening?

Return to the Defender portal section if a control outside the script shows the limitation message.
Reload the Microsoft Learn exercise if the simulation window remains blank.

Help me open the Microsoft Defender portal simulation from the Microsoft Learn exercise.

Open Notepad beside the browser

Analyst notes preserve facts before the investigation grows more complex. A side-by-side layout keeps the evidence visible while you record each observation.

Press the Windows key to open search.
Type Notepad into the search box.

✔️ Notepad appears in the results

Select Notepad from the search results.

You should see a blank Notepad document ready for your report.

ⓧ Notepad is missing

Windows Notepad has a no-cost installation path through Microsoft Support.

Open the Microsoft Support Notepad help page.
Follow the Microsoft Store link on the page.
Install Windows Notepad at no cost.
Press the Windows key after the installation finishes.
Type Notepad into the search box.
Select Notepad from the search results.

Resize the Microsoft Defender simulation window to fill one side of your screen.
Resize Notepad to fill the other side of your screen.

You should see the simulation beside a blank Notepad document. Your workspace now has an evidence pane next to a writing pane.

Create the incident report template

The report headings separate initial leads from verified evidence. This structure helps you trace every final judgment back to something you observed.

Paste the following headings into the blank Notepad document:

Incident title
Initial severity and status
Initial hypotheses
Unknowns
Alert timeline
Entities and scope
Evidence and remediation status
Verdict and confidence
Recommended actions
Escalation note
AI summary audit

How Does the Template Organize Your Investigation?

The headings from Incident title through Unknowns hold your starting case view.
The Alert timeline heading preserves the observed attack sequence.
The Entities and scope heading captures affected assets. The Evidence and remediation status heading records item-level decisions.
The headings from Verdict and confidence through AI summary audit turn your findings into a documented conclusion.

Select File in Notepad.
Select Save As.
Select the Desktop folder as the save location.
Type SOC-Incident-Report.txt in the File name box.
Select OK.

You should see SOC-Incident-Report.txt in the Notepad title bar. Your report shell is saved and ready to collect evidence.

Report Still Showing as Untitled?

Select File if the Notepad title bar still shows an untitled document.
Select Save As.
Save the file as SOC-Incident-Report.txt on your Desktop.

Help me save my Notepad report with the correct filename.

✔️ Awesome, I've got everything!

Everything is in place. Your saved report now contains all eleven investigation headings.

ⓧ I'd like to double check the full code

Incident title
Initial severity and status
Initial hypotheses
Unknowns
Alert timeline
Entities and scope
Evidence and remediation status
Verdict and confidence
Recommended actions
Escalation note
AI summary audit

What Should the Saved Template Contain?

The reference starts with Incident title. It ends with AI summary audit.

Each heading has its own line so later observations stay attached to the correct part of the investigation.

Before you check the whole workspace, which visible details would prove that the evidence view and report template are both ready?

Arrange the Microsoft Defender simulation window beside Notepad.
Confirm the browser shows the Microsoft Defender incident environment.
Scroll from Incident title to AI summary audit in SOC-Incident-Report.txt.

You should see the Microsoft Defender incident environment in the browser. You should see all eleven report headings in Notepad.

Your investigation workspace is ready. Next, you will isolate the ransomware-related incident and capture its initial case details.

Triage the Ransomware Queue

Your investigation workspace is ready. The Microsoft Defender simulation sits beside SOC-Incident-Report.txt, so each queue finding has a place in your notes.

An incident queue helps analysts decide what to examine first. A high-severity ransomware label creates an initial case view.

The Copilot-generated summary is also a lead. This step captures its claims without treating them as a final verdict.

In this step, get ready to:

Filter the incident queue by severity, status, and category.
Review the selected incident summary for an initial case view.
Record a tentative case assessment in your SOC report.

Filter the incident queue

Queue filters reduce a busy incident list to cases sharing the attributes you need. Severity and status narrow this first pass.

Switch back to the Microsoft Defender portal simulation in Microsoft Edge.
Expand Investigation & response in the left navigation.
Expand Incidents & alerts beneath it.
Select Incidents.
Set the severity filter to high severity.
Set the status filter to active.

The queue now shows active high-severity incidents. This gives you a focused starting point for category triage.

Simulation Blocked a Click?

Close the pop-up if the simulation displays This feature isn't available within the simulation..
Return to Incidents through the navigation path you used above.

Ask for help if the scripted controls still do not respond: Help me return to the verified incident queue path in the Microsoft Defender portal simulation.

Isolate the ransomware incident

Category filtering focuses the queue on incidents associated with a specific threat type. The resulting label tells you what to investigate first.

Select add filter.
Set the categories value to Ransomware.

Before you select the case, consider whether these queue labels already prove account compromise. Hold that prediction as you review the summary.

Select User account compromise identified from a known attack pattern.
Review the incident summary in the side menu.

The matching incident summary is now visible in the side menu. It gives you a plausible attack narrative.

Several important questions remain unsupported by evidence at this point. That is your first triage win: you have isolated the right case while keeping the verdict open.

Record the initial case assessment

A hypothesis is a testable explanation for the incident. Keeping two explanations open protects your investigation from settling on the first story it sees.

Open the selected incident from the side menu.
Allow Copilot to generate an incident summary when the simulation prompts you.
Review the generated incident summary.

Why the Summary Stays Provisional

The generated summary condenses the available incident context into a starting narrative. It helps you decide where to investigate.

The summary cannot validate its own claims. Independent observations must support your eventual verdict.

Switch back to Notepad.
Record User account compromise identified from a known attack pattern under Incident title.
Record the displayed case details under Initial severity and status.
Write two possible explanations under Initial hypotheses.
Write two unanswered questions under Unknowns.
Save SOC-Incident-Report.txt in Notepad.

Before you compare the two windows, which details do you expect to match between the incident and your report? Hold that prediction for the final check.

Switch back to the Microsoft Defender portal simulation in Microsoft Edge.
Confirm high severity remains applied.
Confirm active remains applied.
Confirm Ransomware remains applied.
Confirm User account compromise identified from a known attack pattern remains selected.
Confirm the selected incident is open.

You should see the filtered ransomware case open in the simulation. Its generated summary remains available for comparison.

Switch back to Notepad.
Confirm Incident title contains the selected incident title.
Confirm Initial severity and status contains the displayed case details.
Confirm Initial hypotheses contains two possible explanations.
Confirm Unknowns contains two questions that the generated summary does not answer.

Your filtered case and saved notes now agree. You have a defensible starting point for the deeper investigation.

Your initial case view is documented. Next, you'll test that story against raw incident evidence.

Reconstruct the Attack Story

Your filtered ransomware incident is open in the Microsoft Defender portal simulation. Your initial notes capture the Copilot-generated summary.

The summary cannot prove the attack path. Raw alert details supply the first evidence check.

The incident graph adds entity relationships. A process tree reveals the observed sequence.

In this step, get ready to:

Record the analytic-rule context behind the malicious-URL alert.
Assess the IP entity as a relationship within the incident.
Reconstruct the chronological process sequence from the second alert.

Trace the malicious-URL alert

An analytic rule explains why observed activity became an alert. Its context helps you trace the detection to its source.

Return to the alert timeline in the selected incident.
Select Malicious URL In Proxy logs.
Review what happened.
Identify the analytic rule that generated the alert.
Switch back to Notepad from earlier.
Record Malicious URL In Proxy logs under Alert timeline in SOC-Incident-Report.txt.
Record the generating analytic-rule context under the same heading.

Why Capture the Rule Context?

An alert's rule shows which detection logic generated it. This makes the alert traceable to a specific analytic source.

The surrounding evidence determines how much weight the alert deserves.

Alert Details Not Opening?

Return to the selected incident if the alert detail panel is missing.
Select Malicious URL In Proxy logs directly from the alert timeline.
Dismiss This feature isn't available within the simulation. if the pop-up appears.

Help me find the malicious-URL alert details in the Microsoft Defender portal simulation.

Assess the IP relationship

An IP entity adds relationship evidence to an incident. Additional evidence is required before you can conclude that compromise occurred.

Return to the incident graph in the selected incident.
Select 10.50.0.16.
Choose view details.
Review the displayed relationship to determine how the IP connects to the incident.
Switch back to Notepad from earlier.
Record 10.50.0.16 with its displayed incident relationship under Alert timeline.
Add one sentence explaining why that relationship alone does not prove compromise.

That is careful analyst work. Your report now separates a displayed relationship from an unsupported compromise claim.

Rebuild the process sequence

A process tree connects parent activity to child activity. Reading the entries chronologically turns separate observations into a testable sequence.

Return to the alert timeline in the selected incident.
Open Connection to a suspicious domain related to credential phishing.
Inspect the process tree in the alert details.
Trace the displayed processes from earliest to latest.

Process Tree Missing?

Return to the alert timeline in the selected incident.
Select Connection to a suspicious domain related to credential phishing again.
Locate the process tree within that alert's details.

Help me locate and interpret the process tree in the Microsoft Defender portal simulation.

Switch back to Notepad from earlier.
Document the chronological process sequence under Connection to a suspicious domain related to credential phishing in Alert timeline.
Save SOC-Incident-Report.txt.

Before you check the report, do you think every claim in your attack story now traces to a visible source?

Review Alert timeline in SOC-Incident-Report.txt.

You should see both investigated alert names. You should also see the generating analytic-rule context.

The section should include 10.50.0.16 with its displayed incident relationship. It should finish with the observed process sequence in chronological order.

You now have an evidence-backed attack story that reaches beyond the initial summary. Next, you will scope the affected assets plus the remaining response work.

Scope the Impact and Response

The alert sequence in the Microsoft Defender portal simulation now gives you a candidate attack story. The report in Notepad already captures that sequence.

An attack story needs a defined scope before a response can be planned. This step identifies the affected entities shown by the simulation.

You will compare evidence verdicts with remediation status. You will then use recommended actions to prioritize response work.

In this step, get ready to:

Record the affected entities shown in the assets view.
Compare selected evidence items by verdict and remediation status.
Prioritize two recommended actions using their displayed status or impact.

Scope the affected entities

Entity scoping connects incident activity to the people or devices that may need attention. The displayed risk details help you describe that scope without guessing.

Switch back to the selected incident in Microsoft Edge.
Select the assets tab.
Select users.
Select a listed user's name to view that user's page.
Review the displayed risk details for that user.
Switch back to the report in Notepad from earlier.
Record the listed user under Entities and scope.
Add the displayed user risk details beneath that entry.

The user entry gives your attack story a human identity to investigate.

Return to the incident's assets tab.
Select devices.
Select the first listed device.
Select open device page.
Review the displayed risk details for that device.
Switch back to the report in Notepad.
Record the listed device under Entities and scope.
Add the displayed device risk details beneath that entry.

Good progress: your investigation now has a concrete entity scope.

Seeing an unavailable feature message?

Dismiss the pop-up if the simulation shows This feature isn't available within the simulation.
Return to the selected incident from earlier.

Help me get back to the scripted incident workflow.

Evaluate evidence and remediation

An evidence verdict captures Defender's assessment of an analyzed entity. A remediation status shows whether that entity still needs response work.

Return to the selected incident in Microsoft Edge.
Select Evidence and Response.
Select the first evidence item you want to review.
Review the displayed details for that item.
Switch back to the report in Notepad.
Record the item under Evidence and remediation status with its displayed verdict plus remediation status.

One reviewed item provides a starting point. A broader sample gives you stronger evidence for the response decision.

Return to Evidence and Response.
Select a second evidence item.
Review the displayed details for that item.
Switch back to the report in Notepad.
Record the second item with its displayed verdict plus remediation status.

You now have two evidence entries that can be compared for consistency.

Return to Evidence and Response.
Select a third evidence item.
Review the displayed details for that item.
Switch back to the report in Notepad.
Record the third item with its displayed verdict plus remediation status.

How Do Verdicts and Remediation Differ?

A verdict describes how Defender assessed an analyzed entity. The displayed verdict can be Malicious, Suspicious, or Clean.

Remediation status describes the progress of the response work. Recording both fields separates the evidence assessment from the work that remains.

Prioritize the recommended actions

Recommended actions translate investigation findings into response work. Their displayed status or impact helps you decide which actions deserve priority.

Return to the selected incident in Microsoft Edge.
Select Recommended actions.
Select the action you judge to be the highest priority from its displayed status or impact.
Review the displayed details.
Review the displayed implementation status.
Review the displayed impact.
Review the displayed implementation steps.
Review the displayed history.

The first action now has enough context for you to explain its priority.

Return to the Recommended actions list.
Select the action you judge to be the next-highest priority.
Review the displayed details.
Review the displayed implementation status.
Review the displayed impact.
Review the displayed implementation steps.
Review the displayed history.
Compare its response value with the first action.

You now have two response priorities backed by information from the simulation.

Switch back to the report in Notepad.
Locate the Recommended actions heading.
Record the first chosen action using its displayed status or impact to explain its priority.
Record the second chosen action using its displayed status or impact to explain its priority.
Review both entries for a clear reason that each action matters.

Each entry should connect a displayed detail to a response priority.

Save SOC-Incident-Report.txt from Notepad's file menu.

Before you check the finished sections, do you expect every selected item to connect an observation to a response decision?

Review Entities and scope in the saved report.
Review Evidence and remediation status in the saved report.
Review Recommended actions in the saved report.

The Entities and scope section should name at least one listed user. It should also name one listed device with displayed risk details.

The Evidence and remediation status section should contain several reviewed items. Each entry should include its displayed verdict plus remediation status.

The Recommended actions section should contain two priorities. Each priority should include its displayed status or impact plus why it matters.

Missing a Report Detail?

Return to the simulation view that owns the missing detail.
Copy only the information displayed by the simulation into the matching report section.

Help me identify which incident view contains my missing report detail.

Your report now shows the incident's scope. Next, you will turn the evidence into a defensible verdict for escalation.

Resolve and Escalate the Incident

Your Notepad report now holds the investigation evidence you collected. You are ready to turn those observations into an analyst decision.

Evidence becomes operationally useful when it supports a defensible verdict. You will document that judgment with a confidence rating.

You will also write the escalation handoff. Finally, you will resolve the case in the Microsoft Defender portal simulation.

In this step, get ready to:

Decide on an evidence-backed verdict with a confidence rating.
Write a Tier 2 escalation note from the report evidence.
Resolve the incident with a matching incident classification.

Decide the verdict and confidence

An incident label is an initial lead. Your final judgment comes from the timeline, affected entities, evidence verdicts, and remediation state.

What makes a defensible verdict?

The alert timeline shows how the observed activity unfolded over time.
The affected users and devices establish the incident scope.
Evidence verdicts indicate how the reviewed items were assessed.
Remediation statuses show which response gaps remain.

Your report uses one of three verdicts: true positive, informational expected activity, or false positive.

Switch back to Notepad.
Review every completed section in SOC-Incident-Report.txt.
Write the evidence-backed verdict under Verdict and confidence.
Add High, Medium, or Low as the confidence rating under the same heading.
Cite the strongest supporting observations in the same section.
Save SOC-Incident-Report.txt in Notepad.

That is the hardest judgment made. Your report now explains why the verdict deserves its confidence rating.

Write the escalation handoff

An escalation note gives Tier 2 or incident response a compact handoff. It separates confirmed observations from the response work that remains.

Summarize what happened under Escalation note.
State the observed incident impact.
Name the affected users.
Name the affected devices.
Cite the strongest evidence.
Record completed remediation.
Record outstanding remediation.
List the next two actions for Tier 2 or incident response.

Handoff quality check

A strong handoff lets the next analyst understand the evidence without reopening every investigation view. It makes the remaining response work explicit.

Save SOC-Incident-Report.txt in Notepad.
Read the escalation note from the perspective of the receiving analyst.

The note should make the incident impact clear. It should also give the receiving analyst two concrete next actions.

Resolve and classify the incident

Changing the incident status records the investigation outcome in the simulation. Your saved report holds the evidence behind that decision.

Match the classification to your verdict

A supported true-positive verdict maps to True positive with a type of threat.
An informational expected-activity verdict maps to Informational, expected activity with a type of activity.
A false-positive verdict maps to False positive.

Switch back to Microsoft Edge.
Select Manage Incident in the open incident.
Set the Status field to Resolved.
Select the matching option in Classification.

Before you save, which incident status do you expect the simulation to show?

Select save.

The incident User account compromise identified from a known attack pattern should now show the Resolved state. The ransomware filter context remains in the queue.

Can't save the resolved state?

Confirm that you are still working inside the selected incident from the filtered ransomware queue.

If you see This feature isn't available within the simulation., dismiss the message. Return to the scripted incident path before trying again.

Ask for help with the simulation workflow.

Your final report should preserve the evidence behind the resolved classification. Use this checklist before saving it one last time.

Final report checklist

The report keeps every original heading.
The opening sections retain the incident title, initial severity, initial status, hypotheses, and unknowns.
The Alert timeline section names Malicious URL In Proxy logs and Connection to a suspicious domain related to credential phishing.
The Alert timeline section records 10.50.0.16, the analytic-rule context, and the observed process sequence.
The Entities and scope section identifies the reviewed user and device with their displayed risk details.
The Evidence and remediation status section records the reviewed verdicts and remediation statuses.
The Recommended actions section retains the two highest-priority actions.
The Verdict and confidence section contains the evidence-backed verdict, confidence rating, and strongest supporting observations.
The Escalation note section covers what happened, the incident impact, affected users, affected devices, strongest evidence, remediation state, and the next two actions.

Switch back to Notepad.
Compare SOC-Incident-Report.txt with the final report checklist.
Add any missing details under the existing report headings.
Save SOC-Incident-Report.txt again in Notepad.

That is the analyst handoff complete: the simulation records the resolved classification. Your saved report preserves the evidence behind it.

Secret mission

Audit the Copilot Summary

Your verdict is evidence-backed. Audit one important Copilot claim against two independent observations. Then expose one unverified statement and name the telemetry needed to close the gap.

Clean Up Your Resources

Choose whether to keep your report, pause your work, or delete the file. This project costs $0 because the Microsoft Defender portal simulation creates no paid cloud resources.

Resources you used:

A saved local report named SOC-Incident-Report.txt created in Notepad. It contains your completed investigation plus your AI summary audit.

Keep everything running

No action is needed. Choose this option if you want to keep the report for future reference.

Keep SOC-Incident-Report.txt in its current folder so you can review your evidence-backed verdict later.
Remove or replace any simulated names before sharing screenshots publicly.
Leave the resolved simulation incident as it is because no cloud resource continues running.

Pause - I'll come back to this later

Pausing closes the apps while leaving your saved report intact. Choose this option when you plan to return to the investigation later.

Confirm Notepad shows SOC-Incident-Report.txt as the saved file.
Close Notepad.
Close Microsoft Edge.
Return to the Microsoft Learn investigation exercise when you are ready to revisit the simulation.
Reopen SOC-Incident-Report.txt from the folder where you saved it.

Delete - I don't want to use this again

Remove the local report if you no longer need your investigation record. The browser simulation has no cloud resource to delete.

Close SOC-Incident-Report.txt in Notepad.
Return to the folder where you saved SOC-Incident-Report.txt using your Windows file browser.
Select SOC-Incident-Report.txt.
Press Delete to remove the file.
Confirm SOC-Incident-Report.txt no longer appears in the folder.
Close Microsoft Edge after you finish with the simulation.

Nice Work!

Case closed! You completed an evidence-backed ransomware investigation in the Microsoft Defender portal simulation. Your saved SOC report now explains the attack story, affected assets, verdict, and escalation path.

What you learned:

Used incident queue triage to isolate the ransomware case by severity, status, and category. You recorded hypotheses plus unanswered questions before reaching a verdict.
Built a chronological attack story from two alerts, the IP entity 10.50.0.16, and the observed process tree.
Produced an evidence-backed escalation in SOC-Incident-Report.txt. You documented the affected entities, remediation state, confidence level, and next response actions before resolving the incident.
Secret Mission: audited the Copilot-generated summary against raw evidence. You tested an important claim with two independent references. You also identified an unverified statement plus the telemetry needed to investigate it.

Ready to quiz yourself?