Artificial intelligence has transformed nearly every industry, and unfortunately, cybercrime is no exception. Over the past year, threat actors have moved beyond simply experimenting with AI. Instead, they now embed it directly into their operations, using it to write phishing lures, generate exploit code, and even orchestrate entire attack chains with minimal human involvement. Consequently, the speed and scale of attacks have increased dramatically, and traditional defenses are struggling to keep pace.
For defenders, this shift raises an uncomfortable question: how does a blue team keep up when the adversary can launch thousands of personalized attacks per hour? Fortunately, the answer is not to despair, but to fight automation with automation. Modern SIEM platforms such as Microsoft Sentinel, running natively on Azure, give security teams the telemetry, analytics, and automated response capabilities needed to detect AI-driven threats at machine speed. In this post, we explore how attackers weaponize AI, examine a real-world example, and show how Sentinel helps blue teams respond.
Threat intelligence from Microsoft, Google, and Anthropic paints a consistent picture: AI has become standard tradecraft. First, attackers use large language models to research publicly disclosed vulnerabilities and identify exploitation paths far faster than manual research ever allowed. Second, they generate highly convincing, grammatically flawless phishing content tailored to individual victims, eliminating the telltale errors users were trained to spot. Third, they use AI to write and obfuscate malware, and in some cases, to triage stolen data on the victim’s machine before exfiltration.
More worryingly, attacks are becoming autonomous. In November 2025, Anthropic disrupted a state-sponsored espionage operation in which the actor manipulated an AI coding agent into executing reconnaissance, exploitation, credential theft, and lateral movement across targets worldwide, with very little human intervention. When researchers mapped the campaign against MITRE ATT&CK, it spanned 30 techniques across 13 tactics. In other words, a largely automated operation matched the sophistication of an experienced human intrusion team. Therefore, defenders must assume that the volume and complexity of attacks will only grow.
A concrete example from the past year illustrates the stakes. Microsoft’s threat intelligence team published a detailed analysis in March 2026 of Tycoon2FA, a phishing-as-a-service platform operated by the threat actor tracked as Storm-1747. This was not a hobbyist phishing kit. Rather, it was a subscription platform that generated tens of millions of phishing emails per month, was linked to nearly 100,000 compromised organizations since 2023, and at its peak accounted for roughly 62 percent of all phishing attempts Microsoft blocked monthly.
Tycoon2FA specialized in adversary-in-the-middle (AiTM) attacks designed specifically to defeat multi-factor authentication. The platform placed a reverse proxy between the victim and the legitimate Microsoft 365 sign-in page, intercepting credentials and session tokens in real time. As a result, attackers could authenticate as legitimate users without triggering alerts, even after passwords were reset. Moreover, the operation leaned on automation and evasion techniques such as anti-bot screening, browser fingerprinting, dynamic decoy pages, and AI-polished lures that closely mimicked genuine authentication flows. This is industrialized, machine-accelerated phishing, and it renders “just enable MFA” insufficient as a defense strategy.
Legacy security tooling was built around assumptions that no longer hold. Signature-based detection assumes attacks look the same twice, yet AI-generated malware and phishing pages mutate constantly. Similarly, user awareness training assumes phishing emails contain spelling mistakes and awkward phrasing, but Large Language Model(LLM)-written lures are fluent, contextual, and personalized. Meanwhile, point solutions that inspect only email, only endpoints, or only identity each see a fragment of the attack and miss the full chain.
The Tycoon2FA case demonstrates this clearly. The phishing email might pass filters, the sign-in succeeds with valid credentials and a valid MFA claim, and the subsequent mailbox activity appears legitimate. Individually, each event looks perfectly normal. However, when correlated together, the pattern is unmistakable: a phishing click, followed by a sign-in from unfamiliar infrastructure, followed by a new inbox rule and unusual token usage. Detecting that chain requires a platform that sees everything at once. This is precisely where a cloud-native SIEM earns its keep.
Microsoft Sentinel is Azure’s cloud-native SIEM and SOAR platform, and it was designed for exactly this class of problem. To begin with, Sentinel ingests telemetry at cloud scale: Entra ID sign-in logs, Microsoft 365 audit data, Defender XDR alerts, and third-party sources such as firewall logs from Palo Alto Networks, Fortinet, Check Point, and Zscaler all land in one analytics workspace. Crucially, logs from Microsoft Defender XDR and Microsoft 365 ingest into sentinel with major cost benefits (for Microsoft A/E/F/G5 customers), so a Microsoft-first estate gets broad detection coverage before paying for a single third-party gigabyte – a cost lever that disciplined tuning turns into real ROI. Consequently, the blue team gains a single security overview across identity, email, endpoint, network, and cloud.
On top of that data, Sentinel applies multiple detection layers. Out-of-the-box analytics rules from the build-in marketplace like Content Hub specifically target AiTM patterns, for instance by correlating a user’s phishing link click with subsequent suspicious sign-in activity. KQL hunting queries let analysts join sign-in logs, third-party network events, and Defender alert evidence to surface token theft and session hijacking. Furthermore, machine learning capabilities such as Fusion and User and Entity Behavior Analytics (UEBA) detect anomalies that no static rule could anticipate, which is essential when the adversary’s AI generates novel attack variations on every run. In short, Sentinel lets defenders use AI against AI.
Detection alone is not enough when an AI-driven attack moves in minutes. Therefore, Sentinel pairs analytics with automated response through playbooks built on Azure Logic Apps. When an AiTM analytics rule fires, a playbook can immediately revoke the user’s active sessions, force a password reset, disable the compromised account, and push the malicious URL or IP to the perimeter firewall for blocking. Notably, Sentinel’s integration with third-party network vendors means automated disruption extends beyond the Microsoft stack into the existing security estate – a platform-centric but open approach that consolidates where it simplifies operations and integrates best-of-breed where it adds value, with no vendor lock-in.
Additionally, the unified security operations platform brings Sentinel, Defender XDR, and Security Copilot together into one incident queue. Analysts no longer pivot between portals to reconstruct an attack chain. Instead, correlated incidents arrive pre-assembled, with AI-assisted summaries and recommended actions. As a result, mean time to respond drops from hours to minutes, which is the only timescale that matters against autonomous adversaries.
Here is an honest truth that vendors rarely emphasize: deploying a SIEM is the easy part. The real value emerges from tuning. An untuned Sentinel workspace either drowns analysts in false positives or, worse, stays silent because the right data sources were never connected. Effective defense requires deliberate choices about which logs to ingest, which analytics rules to enable, how to set thresholds for your specific user behavior baselines, and which response actions to automate safely.
This is where the right partner makes the difference. As a Microsoft-verified MDXR provider and Microsoft Intelligent Security Association (MISA) member, SoftwareOne helps organizations design, deploy, and operationalize Microsoft Sentinel on Azure – then runs it as a managed detection and response (MDR) service backed by our nine global 24/7 Security Operations Centres. Beyond initial deployment, our team tunes detections to your environment: connecting the data sources that matter, suppressing noise and prioritising the free Microsoft-native logs that strengthen direction without inflating ingestion cost. The result: your team investigates genuine threats instead of chasing ghosts and you measure progress in MTTD, MTTR and false-positive reduction.
The trajectory is clear. Threat actors will continue to push AI deeper into their operations, from reconnaissance through exfiltration, and autonomous attack campaigns will become more common rather than less. There’s a mirror image in this story. The same agentic AI that attackers are weaponizing is the AI your own organization is racing to adopt through Copilot and agents – which changes your risk profile across identity, data and platforms. Defending at machine speed and adopting AI securely are two halves of the same discipline. Blue teams that rely on manual triage and fragmented tooling will fall behind, not because they lack skill, but because human reaction time simply cannot match machine-speed offense.
The good news is that defenders hold structural advantages: they own the environment, the telemetry, and increasingly powerful AI-driven defensive platforms. Microsoft Sentinel on Azure gives security teams the visibility, analytics, and automation needed to detect and disrupt AI-enabled attacks before they become breaches. The organizations that thrive will be those that invest now, deploy deliberately, and tune continuously. If you are ready to take that step, SoftwareOne can help you get there.
Talk to SoftwareOne’s security experts about deploying and tuning Microsoft Sentinel for your environment and securing your AI adoption from day one.
Talk to SoftwareOne’s security experts about deploying and tuning Microsoft Sentinel for your environment and securing your AI adoption from day one.
