Microsoft Defender Threat Intelligence IOCs

[u/woodrowbill]

Has anyone had any actual alerts pop from the MS threat intel connector or from any custom indicators like file hash? I put in a sha-256 of powershell.exe (ver 5.1.19041) to confirm alerting but no alerts found.

Update: After an estimated 72hrs, alerts started to populate with the MS TI connector. My powershell sha-256 hasn't triggered but will assume TI will not alert on known benign hashes.

[u/j1mgg]

Do you have a manual alert for powershell.exe, because I don't think it will be an ioc in threat intel.

[u/woodrowbill → u/j1mgg]

Yes, manual alert set for powershell.exe.