Microsoft Defender Threat Intelligence topics

My companies app incorrectly detected as a trojan

bffan44 — Sat, 18 Oct 2025 00:46:56 GMT

Hi Team.

I am the developer of a gaming geo fence and your system had falsely detected my app as Trojan:Script/Wacatac.C!ml

I need help to remove it as it seems like analysts are no longer checking false detections anymore? ( at least to me it seems automatic now )?

My app is a geo fence which creates firewall rules and use npcaap for packet capture to display server locations and the exe is encrypted to help fight against software pirates.

Here is an example submission of my exe for my application https://www.microsoft.com/en-us/wdsi/submission/5ab00c91-ea84-4fbb-a739-613316b32dfe

Please get an analyst to manually inspect the file and whitelist it as its a pain telling my customers to turn off their anti virus and also its not advice i should have to give to be honest.

My company is called sbmmoff ltd

https://papagal.bg/eik/207176266/58b9

Website is bflocker.com

I really would appreciate a speedy response to resolve the situation and thank you for your time.

Microsoft Defender doesn't, Spy hunter shows a Hijacker

JKFISH — Thu, 18 Sep 2025 19:46:42 GMT

Spy Hunter indicates a "Elex Hijacker" and three other problems were as Defender and McAfee do not show any problem.

Is Spy Hunter legitimate?

I did have a Search engine redirect problem that has a name "ext.ladispatcher.com" and "search-load.com" while using Chrome browser with Chrome search engine. But no problem with Microsoft Edge and Bing.

My monitor screen occasionally momentary collapses and reverts back to normal in a split second. Could there be a connection to malware.?

Please let me know if i am posting on the wrong site.

Need information on generating sample events for Threat Intelligence

aslin — Thu, 04 Sep 2025 13:35:29 GMT

Hi community,

I am working on exploring MS Threat Intelligence and its features. But I am not able to generate sample data for this product, nor able to view the Threat Intelligence logs using Microsoft Management API following the schema - https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype

I tried sending some mails from external email account to my organisation's test user containing EICAR files, and also tried with some safe but malicious test URLs. But still unable to get data inside Threat Intelligence.

Can someone please help me here for generating events and viewing the content using Management APIs?

Need information on generating sample events for Threat Intelligence

swaradajalukar — Thu, 28 Aug 2025 04:04:42 GMT

Hi community,

Can someone please help me here for generating events and viewing the content using Management APIs?

Disable Defender TI access to end user

DarioMWS — Tue, 27 May 2025 16:44:08 GMT

Hi,

When our users access Defender quarantine (or access Defender Admin Center directly), they also get access to Microsoft Defender Threat Intelligence.

Is it possible to disable it and allow access only to the Quarantine?

Thanks,

Dario Woitasen

Can the Microsoft Defender portal show the server details as per security group?

jr-rout — Mon, 12 May 2025 04:38:25 GMT

I'm using Microsoft Defender to monitor the servers.

I have multiple groups of people working from various other vendors. I would like create multiple security groups and add people based on their company and configure the defender such a manner that only people from Company "A" can see their own servers and people working from Campany "B" can see their respective servers. Also, I as admin can see both "A's" and "B's" servers.

Can this be achieved using Microsoft Defender? If yes, how to achieve this? Any step-by-step approach would help. Or if there are any other ways, please suggest. Thanks

New Blog | New Copilot for Security Plugin Name Reflects Broader Capabilities

DavidFernandes — Wed, 02 Oct 2024 16:48:40 GMT

By Michael Browning

The Copilot for Security team is continuously enhancing threat intelligence (TI) capabilities in Copilot for Security to provide a more comprehensive and integrated TI experience for customers. We're excited to share that the Copilot for Security threat Intelligence plugin has broadened beyond just MDTI to now encapsulate data from other TI sources, including Microsoft Threat Analytics (TA) and SONAR, with even more sources becoming available soon.

To reflect this evolution of the plugin, customers may notice a change in its name from "Microsoft Defender Threat Intelligence (MDTI) to "Microsoft Threat Intelligence," reflecting its broader scope and enhanced capabilities.

Since launch in April, Copilot for Security customers have been able to access, operate on, and integrate the raw and finished threat intelligence from MDTI developed from trillions of daily security signals and the expertise of over 10 thousand multidisciplinary analysts through simple natural language prompts. Now, with the ability for Copilot for Security's powerful generative AI to reason over more threat intelligence, customers have a more holistic, contextualized view of the threat landscape and its impact on their organization.

Read the full post here: New Copilot for Security Plugin Name Reflects Broader Capabilities

New Blog | Introducing the MDTI Premium Data Connector for Sentinel

DavidFernandes — Mon, 19 Aug 2024 16:25:37 GMT

By Michael Browning

The MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI data connector available in the Unified Security Operations Platform and standalone Sentinel experiences. The connector enables customers to apply the powerful raw and finished threat intelligence in MDTI, including high-fidelity indicators of compromise (IoCs), across their security operations to detect and respond to the latest threats.

Microsoft researchers, with the backing of interdisciplinary teams of thousands of experts spread across 77 countries, continually add new analysis of threat activity observed across more than 78 trillion threat signals to MDTI, including powerful indicators drawn directly from threat infrastructure. In Sentinel, this intelligence enables enhanced threat detection, enrichment of incidents for rapid triage, and the ability to launch investigations that proactively surface external threat infrastructure before it can be used in campaigns.

This blog will highlight the exciting use cases for the MDTI premium data connector, including enhanced enrichment, threat detection, and hunting to ensure customer organizations are protected against the most critical threats. It will also cover how you can easily get started with this out-of-the-box connector.

Read the full post here: Introducing the MDTI Premium Data Connector for Sentinel

Incorrect Detected as Malware

anguslii — Mon, 29 Jul 2024 07:36:09 GMT

Dear team,

Our apps have been detected incorrectly as malware and we've submitted for screening somehow still flagged as malware.

We tried to appeal and looking for someone to help us how can we remove this flag from defender.

New Blog | More Threat Intelligence Content in MDTI, TA Enables Better Security Outcomes

DavidFernandes — Fri, 28 Jun 2024 21:26:32 GMT

By Michael Browning

Microsoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most relevant to their organization. We are excited to announce that we have recently accelerated the speed and scale at which we publish threat intelligence, giving our customers more critical security insights, data, and guidance than ever before.

This blog will show how our 10,000 interdisciplinary experts and applied scientists reason over more than 78 trillion daily threat signals to continuously add to our understanding of threat actors and activity. It will also show how this increased publishing cadence in Microsoft Defender Threat Intelligence (MDTI), Threat Analytics, and Copilot for Security helps enrich and contextualize hundreds of thousands of security alerts while enhancing customers' overall cybersecurity programs.

Increased Intel Profiles

Microsoft has published 270 new Intel profiles over the past year to help customers maintain situational awareness around the threat activity, techniques, vulnerabilities, and the more than 300 named actors Microsoft tracks. These digital compendiums of intelligence help organizations stay informed about potential threats, including Indicators of Compromise (IOCs), historical data, mitigation strategies, and advanced hunting queries. Intel profiles are continuously maintained and updated by Microsoft's threat intelligence team, which added 24 new Intel profiles in May alone, including 10 Activity Profiles, 4 Actor Profiles, 5 Technique Profiles, and 5 Vulnerability Profiles.

Intel profiles are published to both MDTI and Threat Analytics, which can be found under the "Threat Intelligence" blade in the left-hand navigation menu in the Defender XDR Portal. In Threat Analytics, customers can understand how the content in Intel profiles relates to devices and vulnerabilities in their environment. In MDTI, Intel Profiles enhance security analyst triage, incident response, threat hunting, and vulnerability management workflows.

In Copilot for Security, customers can quickly retrieve information from intel profiles to contextualize artifacts and correlate MDTI and Threat Analytics content and data with other security information from Defender XDR, such as incidents and hunting activities, to help customers assess their vulnerabilities and quickly understand the broader scope of an attack. For example, Copilot can reason over vulnerability intelligence in MDTI and Threat Analytics to deliver a customized, prioritized list based on a customer organization’s unique security posture.

Read the full post here: More Threat Intelligence Content in MDTI, TA Enables Better Security Outcomes

New Blog | Copilot for Security TI Embedded Experience in Defender XDR is now GA

DavidFernandes — Tue, 25 Jun 2024 23:50:55 GMT

By Michael Browning

he Microsoft Defender Threat Intelligence (MDTI) and Defender XDR teams are pleased to announce that the Copilot for Security threat intelligence embedded experience in the Defender XDR portal is now generally available. As of today, Defender XDR customers will see a handy AI-powered sidecar in the Threat Analytics, intel profiles, intel explorer, and intel projects tabs in the threat intelligence blade (in brackets below), which returns, contextualizes, and summarizes intelligence from across MDTI and Threat Analytics about threat actors, threat tooling, and indicators of compromise (IoCs) related to their vulnerabilities and security incidents.

The embedded experience on the right hand side of the Defender XDR portal has an open prompt bar as well as a guided experience with three pre-populated prompts.

Read the full post here: Copilot for Security TI Embedded Experience in Defender XDR is now GA

Massive reduction in Threat Intelligence IP data since Monday 10th June

MikeP751860 — Wed, 12 Jun 2024 09:51:36 GMT

Hi,

Anyone else see a massive reduction in Threat Intelligence IP data since Monday 10th June into Sentinel platforms? I operate two Sentinel environments and they both seen the same change.

The screenshot below is the past 30 days.

The past 48 hours still reports some IP information being sent but at a very reduced rate.

What's changed with the feed?

New Blog | MDTI Achieves PCI DSS Certification: Elevating Security Standards

DavidFernandes — Tue, 30 Apr 2024 21:57:35 GMT

By Ash Luitel

We are excited to announce that MDTI has successfully obtained the Payment Card Industry Data Security Standard (PCI DSS) certification, representing a significant milestone in our continuous pursuit of security excellence. This accomplishment follows closely after our ISO certification, highlighting our unwavering commitment to upholding the highest standards of data protection and our dedication to safeguarding information and proactively combating fraud.

This certification not only strengthens our security measures but also reaffirms the trust our customers have in us to handle their most sensitive data with the utmost care and diligence.

Why the PCI DSS certification matters

PCI DSS is a renowned global standard for securing credit card data and preventing fraud. For organizations that handle sensitive payment information, compliance with PCI DSS is not just a requirement - it's a cornerstone of our promise to safeguard customer data.

Read the full post here: MDTI Achieves PCI DSS Certification: Elevating Security Standards

New Blog | A Copilot for Security Customer’s Guide to MDTI

DavidFernandes — Wed, 03 Apr 2024 16:13:39 GMT

By Michael Browning

With just one Security Compute Unit (SCU), Copilot for Security customers have unlimited access to the powerful operational, tactical, and strategic threat intelligence in Microsoft Defender Threat Intelligence (MDTI), a $50k per seat value, at no extra cost. This compendium of high-fidelity intelligence developed by Microsoft's team of more than 10,000 multidisciplinary security experts and informed by over 78 trillion security signals enables teams to unmask and neutralize adversaries quickly and efficiently.

In this blog, we will review what MDTI is, what you get as a Copilot for Security customer, and how you can immediately tap into this powerful intelligence.

What is MDTI?

MDTI is a threat intelligence product that enables security professionals to directly access, ingest, and act upon trillions of daily security signals in Microsoft's telemetry. MDTI's finished intelligence, including threat articles and intel profiles, provides the latest on cyber threat actors and their tools, tactics, and procedures. Its unique security data sets enable advanced investigations that uncover malicious infrastructure connections across the global cyberthreat landscape to highlight where an organization is vulnerable and address the tools and systems used in cyberattacks.

MDTI is a powerful complement to Microsoft's SIEM, XDR, and AI solutions. Copilot for Security customers can use the incredible depth and breadth of Microsoft threat intelligence in MDTI with Generative AI to quickly understand the full scope of attacks, anticipate the next steps of an ongoing campaign, and drive an optimal security plan for their organizations. They can immediately begin using MDTI in the Copilot for Security standalone experience or embedded experience in Defender XDR. They can also use MDTI directly via the MDTI' analyst workbench' experience in the Threat Intelligence blade in Defender XDR.

Copilot for Security customers can tap into MDTI’s powerful threat intelligence in a variety of ways

Read the full post here: A Copilot for Security Customer’s Guide to MDTI

New Blog | New at Secure: Enhanced Vulnerability Profiles and CVE Search within MDTI

TonyOPS — Fri, 15 Mar 2024 18:09:03 GMT

The Microsoft Defender Threat Intelligence (MDTI) team revamped vulnerability profiles to improve customers’ ability to access world-class intelligence on vulnerabilities and exposures within the Defender XDR portal.

These exciting updates include:

A new layout that mirrors the design of our Threat Actor and Tool intel profiles for a more consistent experience
Vulnerability profiles sorted by published date by default in list view to display a steady feed of new, high importance CVEs
The decoupling of Vulnerability Profiles from open-source Common Vulnerabilities and Exposures (CVEs) so customers can access all available information on vulnerabilities
An enhanced CVE search experience: searches will return all content related to a vulnerability instead of directing a user to a CVE information page.

These enhancements will provide a more intuitive experience for surfacing content related to CVEs, offering critical context on threats and information within alerts and incidents.

What are Vulnerability Profiles?

Vulnerability Profiles are MDTI’s newest intel profile type, launched at Microsoft Ignite in November. Building off our work to introduce intel profiles to MDTI, which has become the definitive source of Microsoft’s shareable knowledge on over 200 threat actors and 70 tools, MDTI now also contains over 75 extensive profiles of the CVEs deemed most critical and relevant by our dedicated security researchers.

Amid the many vulnerabilities teams must keep track of — old and new, with varying degrees of prominence and impact as threat actors adjust their techniques, tactics, and procedures (TTPs) — Vulnerability Profiles tilt the advantage back in favor of defenders by delivering focused, actionable insights and recommendations on how to protect against the most critical CVEs, based on information garnered from Microsoft’s 65 trillion threat signals per day.

By routinely visiting the “Vulnerabilities” tab on the Intel Profiles page in Defender XDR, customers will see a steady stream of new profiles, sorted by published date, indicating CVEs that are considered pressing by Microsoft’s security researchers. This enables CISOs, Vulnerability Managers, SOC Analysts and Cyber Threat Intelligence Analysts alike to remain informed on these CVEs to prioritize detections and implement patching on endpoints and other recommendations in their environment for the vulnerabilities which are most relevant to their organization.

Vulnerability Profiles are accessible from the “Intel profiles” page within the “Threat intelligence” blade in the left navigation. See these profiles by clicking on the “Vulnerabilities” tab:

Vulnerability Profiles are accessible from the “Vulnerabilities” tab on the Intel Profiles page, which is contained under the threat intelligence blade in the left navigation.

On the Vulnerability Profiles list view, the “Profile” column displays the CVE number, title, and summary of the profile, whereas the right-most column displays the published date, indicating how recently Microsoft wrote about the vulnerability. Under the “Intelligence” column in the Vulnerability Profiles list view, customers will see priority and CVSS scores as well as indications of active exploitation (“Active exploitation observed”), dark web chatter (“Chatter Observed”), and available public proof of concept exploits (“POC Available”, "1 Published POC") for these vulnerabilities.

Vulnerability Profiles are decorated with proprietary information from Microsoft’s own research and telemetry that can only be found in our intel profiles. This includes original research such as observations of active exploitation in the wild; detailed analysis of the methods used to exploit these CVEs by malicious actors; detections and Advanced Hunting queries that will indicate or alert on related activity in an organization’s network; and recommendations to protect against the threat.

Read the full post here: New at Secure: Enhanced Vulnerability Profiles and CVE Search within MDTI - Microsoft Tech Community

New Blog Post | New at Secure: MDTI in Defender XDR Global Search

TonyOPS — Fri, 15 Mar 2024 18:03:02 GMT

On the heels of introducing Microsoft Defender Threat Intelligence (MDTI) premium and standard editions into the Microsoft Defender XDR portal, we are thrilled to introduce an even greater integrated threat intelligence experience by making results for MDTI content available within Defender XDR’s global search bar.

Users will notice that they can now use the top-level Defender XDR search to discover results from MDTI on indicators of compromise (IOCs), common vulnerabilities and exposures (CVEs), articles, threat actors and more. From anywhere in the portal, customers now can readily find MDTI raw intelligence including IPs, domains, hashes, and URLs as well as finished intelligence in the form of articles, intel profiles, and CVEs alongside their other content from Defender XDR when conducting searches, helping to accelerate investigations with critical threat intelligence context.

Results from MDTI and Threat Analytics will appear within the “Intel Explorer” list in the results page:

MDTI results are now available under the “Intel Explorer” tab when searching via Defender XDR’s global search bar. You may search and see results for indicators such as IP addresses or file hashes, intel profiles, CVEs, threat articles and more.

Read the full post here: New at Secure: MDTI in Defender XDR Global Search - Microsoft Tech Community

New Blog Post | What's New at Microsoft Secure 2024

TonyOPS — Fri, 15 Mar 2024 17:59:47 GMT

At Microsoft Secure, we are excited to announce several new innovations from the Microsoft Defender Threat Intelligence (MDTI) team. These updates enable our customers to access valuable, high-fidelity threat intelligence where, when, and how they need it:

To optimize MDTI content for customers, we have enhanced the look and feel of vulnerability profiles and are releasing the full corpus of Microsoft’s intel profiles to the MDTI standard version.
We are keeping pace with Copilot for Security as it evolves, launching a new side card experience in the threat intelligence blade of Defender XDR. We have also introduced new MDTI skills and promptbooks for Copilot that deliver more of Microsoft's world-class threat intelligence to the SOC at machine speed.
Finally, as we continue to build a more comprehensive threat intelligence experience across Microsoft Defender XDR, we’re proud to announce that MDTI content is now available via the global search function.

Read more about what's rolling out at Microsoft Secure 2024 below:

New MDTI skills and workbooks for Copilot for Security

MDTI is making more threat intelligence available via new Copilot for Security skills and workbooks to help customers understand the full scope of attacks, anticipate the next steps of an ongoing campaign, and drive an optimal security plan for their organizations at machine speed and scale.

These include:

Correlate MDTI data with Defender XDR information: These out-of-the-box prompt books correlate MDTI data with other critical security information from Defender XDR such as incidents and hunting activities to help a user understand the broader scope of an attack.
Correlate MDTI Content with Threat Analytics (TA) content: When prompted, this skill reasons over threat intelligence content from MDTI and Threat Analytics, and provides a summary of the two, e.g., "Tell me everything Microsoft knows about [this threat actor]."
Obtain current reputation TI for file hashes, URLs, Domains, and IPs: This skill shows the full information for hashes and URLs, including MDTI and SONAR data.

Register for our Tech Community Webinar in April 11 to learn more about how MDTI enables Copilot to deliver threat intelligence at machine speed.

Read the full post here: What's New at Microsoft Secure 2024- Tech Community

New Blog Post | MDTI Standalone Portal Retirement and Transition to Defender XDR

TonyOPS — Sat, 09 Mar 2024 00:02:15 GMT

On June 30th, 2024, the Microsoft Defender Threat Intelligence (MDTI) standalone portal will reach end-of-life and the Microsoft Defender XDR portal will become MDTI’s exclusive home for both standard and premium users. In this blog, we’ll guide customers using the standalone portal that wish to continue using MDTI in Defender XDR through the simple migration process. We’ll also help customers, and their teams, prepare to take advantage of the benefits MDTI brings to Microsoft’s XDR, SIEM, and AI solutions.

What is happening to the MDTI standalone portal?

On June 30th, 2024, the MDTI standalone portal at ti.defender.microsoft.com will be decommissioned. However, customers can seamlessly use the same features and content from MDTI's permanent home in the Microsoft Defender XDR portal in both free and premium capacities. All existing MDTI licenses will carry over to the new portal. Customers can also access this information via natural language prompts by purchasing Copilot for Security.

How do I use MDTI within the Defender XDR portal?

Within Microsoft Defender XDR, users will see the familiar MDTI pages under the “Threat Intelligence” blade in the left navigation menu:

Microsoft Defender Threat Intelligence resources are accessible under the Threat Intelligence blade within the left navigation menu, on the “Intel profiles”, “Intel explorer”, and “Intel projects” tabs.

On the “Intel explorer” tab within Defender XDR (pictured above), you will find the same features and content from the standalone portal Home page. This includes Threat Intelligence Search, Featured Articles, and Recent Threat Article streams.
The content from the Profiles page on the standalone portal is available on the “Intel profiles” tab in Defender XDR.
You can create or access your team and individual projects from the “Intel projects” tab. You can continue working on the same projects you created on the standalone portal by logging into Defender XDR with the same account.

Read the full post here: MDTI Standalone Portal Retirement and Transition to Defender XDR - Microsoft Community Hub

Python Update Recommendation Not Desapearing from Microsoft Vulnerability Management list

mpellizzon — Fri, 01 Mar 2024 19:22:23 GMT

Hello,

Microsoft Defender Vulnerability Management is recommending to update Python in my Azure VM Machines since version 3.9 has some critical vulnerabilities.

We did the update to version 3.12 but only the Windows 2019 Datacenter machine is not appearing as Exposed Device anymore.

The procedure to update Python in all machines was the same but the Windows 2016 Datacenter VM´s remains in the Exposed Device list.

Because Python relies on Anaconda, it is not possible to remove the older version completely. The strange thing is why the same proceduro to update the software is seen as diferent by Microsoft Defender Vulnerability Management apparently.

Any advice is highly appreciated.

Thanks in advance

Mirella

New Blog | MDTI Earns Impactful Trio of ISO Certificates

BrittanyCCP — Mon, 26 Feb 2024 23:57:32 GMT

Microsoft Defender Threat Intelligence (MDTI) has achieved ISO 27001, ISO 27017 and ISO 27018 certifications. The ISO, the International Organization for Standardization, develops market relevant international standards that support innovation and provide solutions to global challenges, including information security requirements around establishing, implementing, and improving an Information Security Management System (ISM).

These certificates emphasize the MDTI team’s continuous commitment to protecting customer information and following the strictest standards of security and privacy standards.

Read the full blog here: MDTI Earns Impactful Trio of ISO Certificates - Microsoft Community Hub