☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview:
  • Microsoft Defender TI Datasets
  • 1. Traditional Data Sets
  • 2. Advanced Data Sets
  • How These Data Sets Support Security Operations
  • Using Defender TI for Threat Hunting
  1. Microsoft Defender TI
  2. Microsoft Defender Threat Intelligence

Data Sets

Overview:

The following section provides an overview of the Datasets that are associated with Microsoft Defender TI.

Microsoft Defender TI Datasets

Microsoft Defender Threat Intelligence (Defender TI) is a powerful tool designed to help security professionals detect, respond to, and proactively prevent threats by leveraging vast amounts of internet infrastructure data. To effectively use Defender TI, it's essential to understand the different data sets it offers and how they can be used in various security scenarios.

1. Traditional Data Sets

These data sets provide foundational information that is commonly used in threat intelligence and cybersecurity operations. They include:

  • Resolutions (PDNS): This data set contains historical DNS resolution records, showing which domains have resolved to specific IP addresses over time. It’s invaluable for tracking the evolution of domain-IP relationships, identifying potential threat infrastructure, and performing time-based correlation.

  • WHOIS Information: WHOIS records provide registration details for domains, such as the registrar, registrant, and contact information. This data can help link different domains or IP addresses to the same owner, even when privacy protections are in place.

  • TLS/SSL Certificates: These certificates are used to secure communications between servers and clients. By analyzing TLS certificates, you can identify connections between seemingly unrelated servers based on shared certificates, helping to uncover broader threat actor infrastructure.

  • Subdomains: Subdomains are extensions of a primary domain and can often reveal additional related infrastructure. Monitoring subdomains can help identify patterns or anomalies that suggest malicious activity.

  • DNS and Reverse DNS: DNS records, including mail exchange (MX), nameserver (NS), and text (TXT) records, provide insights into how domains are structured and connected. Reverse DNS, which maps IP addresses back to domain names, can further uncover related infrastructure.

2. Advanced Data Sets

Advanced data sets dive deeper into the nuances of web infrastructure and are particularly useful for uncovering hidden or sophisticated threat actor activities. These include:

  • Trackers: Trackers are unique codes embedded in web pages, often used for tracking user interactions. Threat actors may inadvertently reuse these trackers across different malicious sites, allowing analysts to connect these sites and identify the threat actors behind them.

  • Components: Web components describe the technologies and services running on a website or server. Analyzing these components can help you understand what a website is built on, identify potential vulnerabilities, and trace threat actor infrastructure based on the technologies they use.

  • Host Pairs: Host pairs represent connections between two pieces of infrastructure (a parent and a child) observed during web crawls. These connections might be simple redirects or more complex relationships like script inclusions. Understanding these relationships can help you identify malicious redirects, skimming attacks, or other nefarious activities.

  • Cookies: Cookies are small data files used by websites to store user information. By analyzing cookies, you can identify commonalities across different websites, uncovering related infrastructure or tracking malicious activity.

  • Services: This data set includes information about the services running on specific ports of an IP address, including the application type, version, and status. It’s useful for identifying potentially vulnerable or misconfigured services that could be exploited by attackers.

How These Data Sets Support Security Operations

Understanding and utilizing these data sets can significantly enhance your ability to:

  • Detect and Respond to Threats: By correlating data across these various sets, you can identify potential threats earlier and respond more effectively.

  • Prioritize Incidents: Not all threats are equal; these data sets help you determine which incidents require immediate attention based on the infrastructure involved.

  • Proactively Identify Malicious Infrastructure: Advanced data sets, in particular, allow you to uncover threat actor infrastructure that might otherwise go unnoticed, enabling proactive measures such as adding domains to blocklists before they can be used in attacks.

Using Defender TI for Threat Hunting

When hunting for threats, start by querying these data sets based on known indicators of compromise (IOCs) like domain names, IP addresses, or certificates. From there, pivot through related data—such as WHOIS records or TLS certificates—to expand your view of potential threats. This comprehensive approach helps you build a more complete picture of the threat landscape and identify connections that might not be immediately obvious.

Last updated 9 months ago