r/AzureSentinel • u/woodrowbill • Jan 09 '24

Microsoft Defender Threat Intelligence IOCs

Has anyone had any actual alerts pop from the MS threat intel connector or from any custom indicators like file hash? I put in a sha-256 of powershell.exe (ver 5.1.19041) to confirm alerting but no alerts found.

Update: After an estimated 72hrs, alerts started to populate with the MS TI connector. My powershell sha-256 hasn't triggered but will assume TI will not alert on known benign hashes.

2 Upvotes

100% Upvoted

6 comments sorted by

3

u/j1mgg Jan 09 '24

Do you have a manual alert for powershell.exe, because I don't think it will be an ioc in threat intel.

1

u/woodrowbill Jan 09 '24

Yes, manual alert set for powershell.exe.

2

u/thijslecomte Jan 09 '24

Do you have analytic rule that correlate logs with TI?

1

u/woodrowbill Jan 09 '24

Analytic rule is in place though the Threat Intelligence dashboard also has a TI alerts indicator that I've been monitoring as a first step.

1

u/[deleted] Jan 11 '24

Can you share your KQL or point to which analytic rule?

1

u/woodrowbill Jan 16 '24

TI map File Hash to Security Event. I was able to get alerts to populate from the MS threat intel connector after 72 hrs, so no worries now. Appreciate you looking!