๐—œ๐—ป๐˜๐—ฒ๐—ด๐—ฟ๐—ฎ๐˜๐—ถ๐—ป๐—ด ๐——๐—ฒ๐—ณ๐—ฒ๐—ป๐—ฑ๐—ฒ๐—ฟ ๐—˜๐˜…๐˜๐—ฒ๐—ฟ๐—ป๐—ฎ๐—น ๐—”๐˜๐˜๐—ฎ๐—ฐ๐—ธ ๐—ฆ๐˜‚๐—ฟ๐—ณ๐—ฎ๐—ฐ๐—ฒ ๐— ๐—ฎ๐—ป๐—ฎ๐—ด๐—ฒ๐—บ๐—ฒ๐—ป๐˜ ๐˜„๐—ถ๐˜๐—ต ๐——๐—ฒ๐—ณ๐—ฒ๐—ป๐—ฑ๐—ฒ๐—ฟ ๐—ง๐—ต๐—ฟ๐—ฒ๐—ฎ๐˜ ๐—œ๐—ป๐˜๐—ฒ๐—น๐—น๐—ถ๐—ด๐—ฒ๐—ป๐—ฐ๐—ฒ

Integration's core goal? Promptly alert you via email if any MDTI insights demand immediate attention.

Here's how it works:

1. Cross-Referencing Domains: Leverage the power of MDEASM by cross-referencing all discovered domains with MDTI articles.

2. Keyword Extraction: Extract keywords from MDEASM's domains and cross-check them with MDTI's database. Even if specific domains aren't mentioned, research might hint at your organization's presence on threat actors' radar.

3. Threat Actor Analysis: Elevate your response by examining the gathered data against Intel Profiles. If a domain or keyword aligns with known threat actors, red flags are waving high.

4. Reputation Check: checking the domains against the transparent reputation score in MDTI. If there is a score then it could be that the your organization has been targeted already or that there is some reputational damage should be rectified urgently

#Cybersecurity #ThreatIntelligence #azure #defender #easm #ti #mdeasm #mdti #cloud #cloudsecurity #xdr #soc #ioc

https://techcommunity.microsoft.com/t5/microsoft-defender-external/one-microsoft-enriching-mdeasm-assets-with-threat-intelligence/ba-p/3905929

Seeking Out Dead and Dying Servers

Peruse any social media platform where InfoSec practitioners interact and share their findings, and you will likely find a mention of the latest and greatest 0-day exploit making the rounds. Although 0-days represent the cutting edge of threat activity, aside from a specific error of backdoors in ea...

TECHCOMMUNITY.MICROSOFT.COM
MDEASM is a tool used by Microsoft Defender to detect expired subdomains which can be vulnerable to takeover. It continuously maps the external-facing resources across an organization's attack surface to identify, classify and prioritize risks, including subdomain expiration and takeover. https://techcommunity.microsoft.com/t5/microsoft-defender-external/identify-digital-assets-vulnerable-to-subdomain-takeover/ba-p/3700773 #MDEASM #MicrosoftDefender #SubdomainTakeover
Identify Digital Assets Vulnerable to Subdomain Takeover

Subdomain takeover vulnerabilities are, in most cases, the result of an organization using an external service and letting it expire. However, that expired subdomain is still a part of the organization's external attack surface, with domain DNS entries pointing to it. An attacker could then claim th...

TECHCOMMUNITY.MICROSOFT.COM