Latest Threat Intelligence (January 25th, 2021)

[arielsgv]

Microsoft has released the January 2021 Threat Intelligence update package. The package is available for download from the Azure Defender for IoT portal  (click Updates, then Download file).

Threat Intelligence updates reflect the combined impact of proprietary research and threat intelligence carried out by Microsoft security teams. 

What does the Threat Intelligence (TI) package include?

The January Threat Intelligence package includes the latest detections for the SolarWinds Orion Breach; More than a month into the discovery of Solorigate, investigations continue to unearth more details the second-stage exploitation:

1. Detections for the Sunburst, Supernova and Raindrop backdoors.
2. Payloads associated with these backdoors – indicators for use of the FireEye red-team tools and cobalt strike payload.

For more information, go to Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop - Micr...

In addition, the package also includes the latest CVEs publications applicable for IoT/ICS/OT networks.

We highly recommend that you deploy the latest TI package!

Update your system with the latest TI package:

The package can be downloaded from the Azure Defender for IoT Portal, Updates page:

To update a package on a single sensor:

1. Go to the Azure Defender for IoT Updates page.
2. Download and save the Threat Intelligence package.
3. Sign into the sensor console.
4. On the side menu, select System Settings.
5. Select Threat Intelligence Data, and then select Update.
6. Upload the new package.

To update a package on multiple sensors simultaneously:

1. Go to the Azure Defender for IoT Updates page.
2. Download and save the Threat Intelligence package.
3. Sign into the management console.
4. On the side menu, select System Settings.
5. In the Sensor Engine Configuration section, select the sensors that should receive the updated packages.
6. In the Select Threat Intelligence Data section, select the plus sign (+).
7. Upload the package.

For more information, please review Update threat intelligence data | Microsoft Docs

Ahi Booganim,  Azure Defender for IoT , Senior Program Manager

@arielsgv, Azure Defender for IoT , Senior Program Manager