Edit

Tutorial: Gather vulnerability intelligence

  • Applies to: Microsoft Defender XDR, Microsoft Sentinel in the Microsoft Defender portal

This tutorial walks you through how to perform several types of indicator searches to gather vulnerability intelligence using Microsoft Threat Intelligence in the Microsoft Defender portal.

Prerequisites

Disclaimer

Microsoft Threat Intelligence might include live, real-time observations and threat indicators, including malicious infrastructure and adversary-threat tooling. Any IP address and domain searches in the Defender portal are safe to search. Microsoft shares online resources (for example, IP addresses and domain names) that are considered real threats posing a clear and present danger. Use your best judgment and minimize unnecessary risk while interacting with malicious systems when performing this tutorial. Microsoft minimizes risks by defanging malicious IP addresses, hosts, and domains.

Before you begin

As the disclaimer states previously, suspicious and malicious indicators are defanged for your safety. Remove any brackets from IP addresses, domains, and hosts when searching. Don't search these indicators directly in your browser.

Open Intel explorer in the Microsoft Defender portal

  1. Access the Defender portal and complete the Microsoft authentication process. Learn more about the Defender portal
  2. Navigate to Threat intelligence > Intel explorer.

Learn about Intel explorer home page features

  1. Review the Intel explorer search bar options by selecting its drop-down menu.
  2. Scroll down and review the featured and recent articles in their respective sections.

Perform indicator searches and gather vulnerability intelligence

  1. Search CVE-2020-1472 in the Intel explorer search bar, then select and review the associated Intel profile CVE-2020-1472 - Netlogon Elevation of Privilege vulnerability.

  2. Select the profile's Related articles tab then select the article Graphican: Nylon Typhoon (NICKEL) Uses New Backdoor in Attacks Targeting Foreign Ministries.

  3. Select this newly opened article's Public indicators. You should see the IP address 50.116.3[.]164 among the listed indicators.

  4. Navigate back to the Intel explorer search bar and search 50.116.3[.]164.

  5. Review the following results in the Summary tab:

    • Reputation
    • Articles
    • Services
    • Resolutions
    • Certificates

    You can also select and review the information in the corresponding tabs.

  6. Select the Resolutions tab then select piwik.enpers[.]com.

  7. Review this domain's resolutions, WHOIS, certificates, subdomains, trackers, components, cookies, DNS, and reverse DNS data sets.

  8. Perform the respective artifact searches from the previous steps. You could reference and use the different search options in the Intel explorer search bar dropdown menu.

Clean up resources

There are no resources to clean up in this section.

Related content

  • Last updated on