Question

A SOC analyst opens a Threat Analytics report in the Microsoft Defender portal for an emerging ransomware campaign. The report includes a section listing techniques with pre-built Advanced Hunting queries authored by Microsoft threat intelligence. The analyst wants to determine whether any devices in the organization have already shown activity matching this specific campaign's tradecraft, with the least effort and highest fidelity. What should the analyst do?

Accepted Answer

Select the recommended hunting queries embedded in the Threat Analytics report and run them directly in Advanced Hunting to check tenant data for matches.

Answer

Manually write new KQL against the DeviceTvmInfo table to look for the campaign's vulnerabilities across all devices.

Answer

Create a custom detection rule from a blank query template and wait for it to generate alerts over the next 24 hours.

Answer

Export the report's indicators to Microsoft Sentinel as threat intelligence and build a Fusion rule to correlate them.