Microsoft security researchers have been investigating and responding to the recent nation-state cyber-attack involving a supply-chain compromise followed by cloud assets compromise.
Microsoft 365 Defender can help you track and respond to emerging threats with threat analytics. Our Threat Intelligence team has published a new Threat analytics report, shortly following the discovery of this new cyber attack. This report is being constantly updated as the investigations and analysis unfold.
The threat analytics report includes deep-dive analysis, MITRE techniques, detection details, recommended mitigations, updated list of indicators of compromise (IOCs), and advanced hunting queries that expand detection coverage.
Given the high profile of this threat, we have made sure that all our customers, E5 and E3 alike, can access and use this important information.
If you’re an E5 customer, you can use threat analytics to view your organization’s state relevant to this attack and help with the following security operation tasks:
- Monitor related incidents and alerts
- Handle impacted assets
- Track mitigations and their status, with options to investigate further and remediate weaknesses using threat and vulnerability management.
For guidance on how to read the report, see Understand the analyst report section in threat analytics.
Read the Solorigate supply chain attack threat analytics report:
- For unified Microsoft 365 Defender early adopters, use this link: Threat Analytics - Microsoft 365 security
- For Microsoft Defender for Endpoint customers, use this link: Threat overview - Microsoft Defender for Endpoint
For our E3 customers, you can read similar relevant Microsoft threat intelligence data, including the updated list of IOCs, through the MSRC blog. Monitor the blog, Customer Guidance on Recent Nation-State Cyber Attacks, where we share the latest details as the situation unfolds.