Microsoft Defender Threat Intelligence - Simply Explained

0:00 The alert on your screen never tells you who is attacking you. It tells you something broke and then it leaves you guessing. Microsoft Defender Threat Intelligence is built to answer the part the alert skips. Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work. Today we are unpacking it in plain words with no security degree required. By the end, you will see how one suspicious domain can lead straight to a criminal operation. What threat intelligence actually is. Every security tool you own is loud. In the same way, an alert fires, a red banner appears and you are told that something went wrong somewhere. What none of those alerts explain is who did it, what they wanted, or whether they have run the same trick on a hundred other companies this month.

0:41 That gap is the space threat. Intelligence fills threat. Intelligence is evidence based knowledge about threats, the kind that helps you decide what to do next instead of reacting to a blinking light, raw data tells you that a login failed. Intelligence tells you that the login came from infrastructure tied to a known ransomware crew. Microsoft Defender Threat Intelligence is Microsoft's version of that idea. Microsoft describes it as a complete threat intelligence platform. It lets security teams take in, analyze and act on massive signal collected from across the internet, processed by security experts and machine learning. The last part matters because the signal doesn't come only from your network. It comes from everywhere. The product blends two kinds of material. Finished intelligence is the human readable side threat actor profiles, written reports, and threat analytics.

1:25 Raw intelligence is the ground truth underneath it. Passive DNS records, voice registration details, SSL certificates, internet infrastructure, and indicators of compromise. Passive DNS is a running log of what domains resolve to which addresses over time, and whois is the registration paperwork that sits behind a domain. The finished side tells you the story, and the raw side lets you check it for yourself. The origin of all this deserves one sentence. Microsoft announced its plan to buy a security company called RiskIQ in July twenty twenty one, and it launched Microsoft Defender Threat Intelligence in August twenty twenty two. Built on that acquisition, RiskIQ was known for watching the internet at scale, and that habit is baked into the product today.

2:06 The capability has a new home. Microsoft retired the standalone portal in August twenty twenty six and folded the work into Microsoft Defender and Microsoft Sentinel. The name on a slide is now the same idea you find inside the tools a security team already opens every morning. You don't need to be a security analyst to follow any of this. The value of threat intelligence is context, and context is something anyone can reason about. If an alert is a knock at the door, threat intelligence is knowing who tends to knock like that. It's also worth knowing why this matters. Even if you never touch a security console threat. Intelligence is the reason a company can name the criminal group behind a breach instead of shrugging at it. It's the difference between reading a scary headline and understanding what really happened. Once you can see the structure behind the noise, the security news you scroll past every week starts to make sense.

2:49 Indicators of compromise the breadcrumbs. Before you can spot an attack, you need something concrete to look for. And that is what an indicator of compromise gives you. Simply put, it's a piece of evidence on a network or a device that suggests an intrusion has happened. These clues come in three broad families. Network indicators cover the traffic side, such as the malicious IP address and DNS lookup, or a connection to a command and control server. Host indicators live on the device itself, and they include a file hash, a changed registry key, or a process running from a folder where it has no business running. Email indicators show up in the inbox, whether that is a spoofed sender, a suspicious attachment, or a link that leads to a credential stealing page. A phishing email that impersonates a bank is a tidy example, because the sender address, the link and the landing page each count as separate indicators.

3:33 It helps to separate indicators from a second idea that often gets mixed in with them. An indicator is evidence that something already happened, much like a fingerprint left at a scene. A tactic, technique, and procedure usually shortened to TTP, describes how an attacker operates, such as the habit of breaking in through a fake login page. Indicators go stale fast because an attacker can swap a domain or rebuild a file overnight, while a TTP lasts longer. Because changing a habit is harder than changing an address. A few of these terms deserve a plain explanation. A file hash is a short digital fingerprint of a file, and it stays the same even if someone renames that file. command and control traffic is the channel an attacker uses to give orders to malware already running inside a network. Beaconing is what that channel looks like from the outside, which is a device quietly checking in with the same server on a timer over and over.

4:20 A single clue only goes so far on its own. Microsoft Defender Threat Intelligence rates hosts domains and IP addresses on a scale from zero to one hundred, then sorts them into buckets. A score from seventy five to one hundred is treated as malicious. Fifty to seventy four is suspicious, twenty five to forty nine is neutral, and anything below twenty five is unknown. Those scores come from machine learning rules that weigh things like the domain ending, the hosting provider, the name server, the registrar, and the certificate. A score is a starting point for judgment, not a verdict, because the combination of signals is what predicts trouble. The trap most beginners fall into is treating one indicator as proof. A single suspicious IP address is weak on its own. Because attackers share and recycle infrastructure constantly, and a single file hash can be changed in a second.

5:05 Real signal shows up when several indicators point at the same place at the same time. And that pattern is what turns noise into a lead. Hold on to that thought, because a single domain is about to do exactly this in a real breach, and we will walk through it in a few minutes. Threat actors. Who is behind the attack? Now here is where it gets interesting. Indicators tell you what is happening and they rarely tell you who is holding the pen. That missing name is what an actor profile supplies a threat. Actor is the person or group carrying out an attack, and Microsoft keeps a running profile of the ones it tracks. The names are the first thing people notice because Microsoft names threat actors after. Whether you might expect the names to be random, but each word carries meaning. A family name signals either where an actor comes from or what drives them.

5:47 Typhoon points to China. Blizzard points to Russia. Sandstorm points to Iran and sleet points to North Korea. Tempest marks financially motivated criminals. Tsunami marks private sector offensive actors and flood marks influence operations. When a group is new and not yet understood, Microsoft gives it a temporary label instead of a name. These labels show up as the word storm, followed by a four digit number like storm zero five five eight. The label means the activity is real, but the identity behind it is still being worked out. And once Microsoft is confident the group graduates to a proper name, Microsoft sorts all of this into five categories nation state actors work for or on behalf of a government, and most of them aim at government agencies, international organizations and think tanks for espionage.

6:28 Financially motivated actors chase money through ransomware, business email compromise and phishing. Private sector offensive actors are commercial companies that build and sell cyber weapons, influence operations, try to shift what people believe rather than break into systems. Groups and development are the ones still being identified. A profile is more than a name. It gathers the actor's known tactics the industries and regions. They tend to target, the infrastructure they lean on and the malware families tied to them. Microsoft then maps its own names to the names other vendors use. So Forrest Blizzard is also known as Fancy Bear and as Apt28, when everyone can translate the names, a defender who reads three different reports can tell they are all describing the same adversary. It pays to be honest about attribution because it is a judgment built from evidence rather than uncertainty.

7:13 And that is exactly why the temporary storm labels exist. A group in development is Microsoft saying that the activity is clear while the identity behind it is not? Which is a more useful answer than a confident guess. One last term rounds out the vocabulary meter. A tank is a free public knowledge base of adversary tactics and techniques based on real world observations, and it's the shared language analysts use to describe how an attack is carried out. An actor profile and an A tank technique together give you the who and the how that a bear alert never provides. Infrastructure analysis following the trail. Knowing who an attacker is leads to the next question, which is where they live. Online infrastructure analysis means mapping the servers, domains, and services an attacker uses to run an operation, and those pieces turn out to be far more connected than most people expect.

7:58 Microsoft calls the technique infrastructure chaining. The internet is a tightly connected place, so one indicator can expand into many. When two pieces share a detail, a domain and a certificate can share an issuer and two IP addresses can share a name server, follow enough shared details and one clue becomes a map. The data that makes this work is the raw material of the product. Passive DNS and DNS history show what resolved to what and when, who is and who is history. Show who registered a domain and how they tried to hide their identity, subdomains, SSL certificates, services, components, trackers, and cookies each add another thread. Then there are host pairs which show connections between websites based on what one page loads from another, a relationship that passive DNS and wikis would never surface on their own.

8:39 There is a reason this approach works so well. Attackers reuse infrastructure because building it is expensive and slow, so the same server, registrar or certificate tends to show up across many campaigns. Microsoft also defangs the malicious addresses and domains it publishes, which means the dots are swapped out for safety so anyone can look them up without accidentally visiting the attacker's own site to see how this plays out. Take a real case Microsoft documents In October twenty eighteen, a criminal group known as Magecart got into the online store of MyPillow, a pillow company. It injected a script that stole customer's payment details as they typed them in. The script didn't sit on my pillows own servers because it was hosted on a lookalike domain spelled almost the same as the real one. When analysts followed that domain, the threads started connecting.

9:20 The fake domain had been registered through the same registrar online in IC as the Typosquatting domain. Both used the same privacy service domain ID shield. The fake domain resolved to an IP address hosted in Russia, and the two domains sat on different autonomous systems, which is how the internet groups large blocks of addresses. None of those details proves anything alone, but together they tied separate pieces of the same campaign to one operation. The pattern repeated later. Magecart planted a second skimmer, this time disguised as a live chat service and the fake chat domain. Live chatting dot org resolved to another Russian IP address. Its registration used the same registrar and the same privacy service as the earlier Typosquatting. The oddity was visible to anyone looking because a Chinese privacy service was guarding a Russian address for what was supposed to be a United States company.

10:05 This is the single domain from earlier, and this is where it lands. What makes the story worth telling is that nobody found a single smoking gun. Investigators found overlapping details, and those overlaps did the work. That's infrastructure analysis and in practice, and it's why a product built on internet wide observation can see connections that a scan of your own network never will. Using it in an investigation. All of this raises an obvious practical question, which is how a security team puts any of it to work on a normal day. The answer is that the intelligence sits inside the workflow they already run, rather than in a separate tool. They have to remember to open. Inside the Microsoft Defender portal. Threat intelligence shows up in two main places. The overview page summarizes what matters right now, including an executive summary, the latest threats, and a library of threat articles.

10:49 It also flags the threats with the highest impact, and the ones your organization is most exposed to. The Intel Explorer is the search side. You can browse by campaign indicator, attack pattern, identity, threat, actor tool, vulnerability, or report and filter by the industry and the region being targeted. The richest detail appears when you open a single entity. An entity is just one thing you are curious about, such as an IP address, a domain, a URL, or a file. Each of those has a page with a Threat Intelligence tab that pulls together reputation. Any threat reports that mention it. infrastructure, relationships, and for URLs and files, the results of running it in a sandbox. The workflow itself is short and repeatable. An analyst opens an incident, selects one of the entities involved, reads the enrichment on that entity's page, and then follows the connections out to related entities and reports that outward move is the whole game.

11:38 One domain leads to a certificate. The certificate points to a hosting provider, and the hosting provider opens up a dozen more domains tied to the same actor. Picture that with a real alert, a user reports a strange login, so the analyst opens the incident and the suspicious domain behind it becomes the first entity to check the entity. Page says the domain is malicious, names a threat actor and lists a handful of related domains. Two clicks later, the team has a list of addresses to block and a clearer sense of who is on the other side. There is an automation layer above the manual work. Microsoft Graph exposes a threat intelligence interface, which lets a team enrich indicators automatically. Instead of looking each one up by hand. A Microsoft Sentinel connector then syncs those indicators into analytics rules and hunting queries.

12:18 Put simply, the same intelligence a person reads on a page can also feed the tools that watch for trouble around the clock. Microsoft has also added assistance here. Threat analytics reports bring in research from Microsoft's security teams, and they can fold in data from your own environment. Copilot Insight Defender can summarize intelligence and help prioritize which threats touch your organization. The point of all of it is the same. Open a case. Look at one clue. Read what the product knows about it, and then follow the connections outward. The manual version teaches you the logic, and the automated version runs that logic at a speed no person can match. Community versus premium. What is free and what is not. The last practical question is the one everyone asks about any Microsoft product, which is what it costs for most of its life.

13:01 Access to Microsoft Defender Threat Intelligence came in two levels a free community edition and a paid premium tier. The Community Edition was the on ramp. Microsoft described it as a free, lightweight version that offered the same threat hunting experience, just with limited access to the data sets. Anyone with a Microsoft account could sign up, which meant a curious beginner could explore real threat data without a purchase order. The community tier was never a demo that expired after a trial because it was a standing no cost way into the platform. The differences between the two came down to depth and history in the community tier. Several data sets kept only fourteen days of history, including components DNS and reverse DNS, passive DNS resolution, SSL certificates and trackers. Community users didn't get reputation scores, host pairs, cookies, Analyst Insights, or w h o history, and they were limited to five projects that stayed private.

13:49 Premium removed those ceilings, added the missing data sets, and allowed shared team projects, along with a thirty day trial to test it. The gap that matters most is history. Fourteen days of passive DNS gives you a snapshot, while unlimited history gives you a timeline, and infrastructure analysis depends on seeing how connections changed over months. The split was never about a better or worse product, because it was always about how far back you could look. Access was also licensed per user, which is why a security team might hand the full experience to the analysts who live in it, and the free version to everyone else. That detail tells you who each tier was built for. The community edition served the curious and the premium tier served the people whose whole job was to follow the trail. That model has since changed. The standalone premium product has been retired, and the capability now lives inside Microsoft Defender, where premium threat intelligence comes with eligible defender licensing instead of a separate add on.

14:38 A single connector also pushes those indicators into the tools that watch a network. So the intelligence reaches the software as well as the people. The trend is easy to see because the intelligence is treated less like a product you buy, and more like a feature of the security tools a team already owns. For a beginner, the takeaway is reassuring. The concepts are identical whether you are on a free tier or a paid one. If you understand what an indicator an actor and an infrastructure chain are, you already understand the paid product and the free version was always enough to learn on. Where this leaves you. So that's the full picture. Threat intelligence turns one clue into a map of who is attacking and what they touch next. Microsoft Defender Threat Intelligence is where Microsoft keeps that map, and it now lives inside the tools many teams already use.

15:19 The question I leave you with is this if one domain can expose a whole operation, how many clues sit in your environment right now?