https://securitynews.ms/products/microsoft-threat-intelligence/Microsoft Threat Intelligence news and documented product changes, each linked to Microsoft's own source.enThu, 12 Nov 2026 17:00:00 +0000https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/Thu, 12 Nov 2026 17:00:00 +0000Microsoft Threat IntelligenceMicrosoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/Wed, 11 Nov 2026 19:49:57 +0000Microsoft Threat IntelligenceThreat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity.https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/Tue, 10 Nov 2026 23:00:00 +0000Microsoft Threat IntelligenceMicrosoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by…https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sectorhttps://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sectorSat, 07 Nov 2026 02:44:34 +0000Microsoft Security BlogIn October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/Thu, 05 Nov 2026 16:00:00 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security…https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/Tue, 03 Nov 2026 17:32:47 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/Mon, 02 Nov 2026 20:20:59 +0000Microsoft Threat IntelligenceReal-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius.https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/Sat, 31 Oct 2026 01:02:57 +0000Microsoft Threat IntelligenceMicrosoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/Fri, 30 Oct 2026 16:11:44 +0000Microsoft Threat IntelligenceTeams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/Thu, 29 Oct 2026 16:00:00 +0000Microsoft Threat IntelligenceAs Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. This blog breaks down how North…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/turn-threat-intelligence-into-informed-action-with-microsoft/ba-p/4566636https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/turn-threat-intelligence-into-informed-action-with-microsoft/ba-p/4566636Thu, 22 Oct 2026 17:06:53 +0000Microsoft Defender XDR BlogEvery new threat raises a familiar set of questions. Is it targeting our industry? Are we exposed? What should we investigate first? Answering those questions takes more than another feed or a longer list of indicators. It takes intelligence that brings the…https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromisehttps://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromiseWed, 21 Oct 2026 18:23:55 +0000Microsoft Security BlogStorm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/Wed, 14 Oct 2026 13:00:00 +0000Microsoft Threat IntelligenceMicrosoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners…https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/Wed, 30 Sep 2026 14:00:00 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/Tue, 29 Sep 2026 21:39:27 +0000Microsoft Threat IntelligenceMicrosoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activityhttps://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/Tue, 29 Sep 2026 15:00:00 +0000Microsoft Threat IntelligenceSince January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/Mon, 28 Sep 2026 15:00:00 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principalshttps://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principalsFri, 25 Sep 2026 15:35:08 +0000Microsoft Security BlogMicrosoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders.https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/Thu, 24 Sep 2026 16:00:00 +0000Microsoft Threat IntelligenceStorm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/Tue, 22 Sep 2026 15:00:00 +0000Microsoft Threat IntelligenceEvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/Thu, 10 Sep 2026 17:23:05 +0000Microsoft Threat IntelligenceMicrosoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/Wed, 09 Sep 2026 17:41:18 +0000Microsoft Threat IntelligencePasskey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance.https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/Thu, 03 Sep 2026 16:00:00 +0000Microsoft Threat IntelligenceInvisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them.https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-accesshttps://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-accessWed, 02 Sep 2026 22:51:18 +0000Microsoft Security BlogMicrosoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and…https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/Tue, 01 Sep 2026 22:48:28 +0000Microsoft Threat IntelligenceAn active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations…https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/Sat, 29 Aug 2026 03:43:27 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-threat-intelligence-briefing-agent/4390821https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-threat-intelligence-briefing-agent/4390821Tue, 11 Aug 2026 13:45:40 +0000Microsoft Defender XDR BlogAs cyber threats rapidly evolve, security teams are overwhelmed by the sheer volume of threat intelligence, making it challenging to deliver timely, targeted...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-mdti-home-page-widget-and-article-digest/4223917https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-mdti-home-page-widget-and-article-digest/4223917Tue, 11 Aug 2026 13:45:34 +0000Microsoft Defender XDR BlogThe MDTI team is excited to introduce the MDTI Article Digest, a new way for customers to stay up to speed with the latest analysis of threat activity...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-mdti-premium-data-connector-for-sentinel/4220346https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-mdti-premium-data-connector-for-sentinel/4220346Tue, 11 Aug 2026 13:45:31 +0000Microsoft Defender XDR BlogThe MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI Premium data connector available in the Unified Security Operations...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/more-threat-intelligence-content-in-mdti-ta-enables-better-security-outcomes/4177542https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/more-threat-intelligence-content-in-mdti-ta-enables-better-security-outcomes/4177542Tue, 11 Aug 2026 13:45:30 +0000Microsoft Defender XDR BlogMicrosoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-earns-impactful-trio-of-iso-certificates/4067591https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-earns-impactful-trio-of-iso-certificates/4067591Tue, 11 Aug 2026 13:45:17 +0000Microsoft Defender XDR BlogWe are excited to announce that Microsoft Defender Threat Intelligence (MDTI) has achieved ISO 27001, ISO 27017 and ISO 27018 certifications.https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/unified-mdti-apis-in-microsoft-graph-now-ga/3981912https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/unified-mdti-apis-in-microsoft-graph-now-ga/3981912Tue, 11 Aug 2026 13:45:11 +0000Microsoft Defender XDR BlogWe’re thrilled to share that the unified APIs that are part of the Microsoft Graph are now generally available! These APIs come with a single endpoint,...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-adds-microsoft-threat-intelligence-to-silobreaker/4013296https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/mdti-adds-microsoft-threat-intelligence-to-silobreaker/4013296Tue, 11 Aug 2026 13:45:11 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence (MDTI) adds Microsoft Threat Intelligence reputation enrichment to Silobreaker!https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-mdti-helps-power-copilot-for-security/3973731https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-mdti-helps-power-copilot-for-security/3973731Tue, 11 Aug 2026 13:45:08 +0000Microsoft Defender XDR BlogThis blog post will delve into Copilot for Security, focusing on the strategic utilization of Microsoft Defender Threat Intelligence (MDTI), a comprehensive...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/using-mdti-with-the-diamond-model-for-threat-intelligence/3976100https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/using-mdti-with-the-diamond-model-for-threat-intelligence/3976100Tue, 11 Aug 2026 13:45:05 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence (MDTI) provides robust tools and features that enable security analysts to quickly investigate incidents and respond...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/unleash-the-power-of-threat-intel-introducing-the-mdti-github/3884452https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/unleash-the-power-of-threat-intel-introducing-the-mdti-github/3884452Tue, 11 Aug 2026 13:44:59 +0000Microsoft Defender XDR BlogAre you looking to enhance your organization's security processes? The Microsoft Defender Threat Intelligence (MDTI) GitHub offers technical solutions for...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-mdti-intel-reporting-dashboard-and-workbook/3812899https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-mdti-intel-reporting-dashboard-and-workbook/3812899Tue, 11 Aug 2026 13:44:59 +0000Microsoft Defender XDR BlogWe are excited to announce the launch of a new dashboard that we have created to enhance our threat intelligence reporting capabilities. This dashboard...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/new-threat-actor-intel-profiles-added-to-mdti/3841181https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/new-threat-actor-intel-profiles-added-to-mdti/3841181Tue, 11 Aug 2026 13:44:59 +0000Microsoft Defender XDR BlogThe Microsoft Defender Threat Intelligence (Defender TI) team has recently launched twenty-six new threat actor Intel Profiles, and more than 50 additional...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-mdti-microsoft-sentinel-playbooks/3780096https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-new-mdti-microsoft-sentinel-playbooks/3780096Tue, 11 Aug 2026 13:44:52 +0000Microsoft Defender XDR BlogDuring Microsoft Secure, we announced new capabilities that help enterprise users power up automation with Defender Threat intelligence, including an...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/performing-a-successful-proof-of-concept-poc/3742412https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/performing-a-successful-proof-of-concept-poc/3742412Tue, 11 Aug 2026 13:44:47 +0000Microsoft Defender XDR BlogTo effectively determine the benefits of adopting Defender Threat Intelligence, you should perform a Proof of Concept (PoC). Before enabling Defender Threat...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/infrastructure-chaining-with-microsoft-defender-threat-intelligence/3687956https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/infrastructure-chaining-with-microsoft-defender-threat-intelligence/3687956Tue, 11 Aug 2026 13:44:43 +0000Microsoft Defender XDR BlogInfrastructure Chaining is used to investigate the relationships between connected datasets which allows an analyst to develop an investigation into events...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/become-an-mdti-ninja-the-complete-level-400-training/3656965https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/become-an-mdti-ninja-the-complete-level-400-training/3656965Tue, 11 Aug 2026 13:44:41 +0000Microsoft Defender XDR BlogLearn how to become a Microsoft Defender Threat Intelligence (MDTI) Ninja! This blog will walk you through the resources you'll need to master and make best...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-in-an-mdti-web-crawl/3659047https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/whats-in-an-mdti-web-crawl/3659047Tue, 11 Aug 2026 13:44:38 +0000Microsoft Defender XDR BlogWant to learn how data found from the DOM of web pages is so powerful when it comes to investigating threats? Check out this blog to learn more about...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-microsoft-defender-threat-intelligence-community/3657956https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/introducing-the-microsoft-defender-threat-intelligence-community/3657956Tue, 11 Aug 2026 13:44:37 +0000Microsoft Defender XDR BlogCome learn about the differences between Microsoft Defender Threat Intelligence's Community vs. Premium level of access.https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/understanding-and-using-finished-threat-intelligence/3658990https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/understanding-and-using-finished-threat-intelligence/3658990Tue, 11 Aug 2026 13:44:34 +0000Microsoft Defender XDR BlogRaw versus finished cyber threat intelligence? What's the difference and why should I care about both? Check out this blog to learn why!https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/getting-the-most-out-of-projects-in-defender-ti/3658964https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/getting-the-most-out-of-projects-in-defender-ti/3658964Tue, 11 Aug 2026 13:44:32 +0000Microsoft Defender XDR BlogWant to learn about an easier way to collaborate with peers during investigations? Look no further! Microsoft Defender Threat Intelligence's Projects feature...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/getting-started-with-microsoft-defender-threat-intelligence/3657379https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/getting-started-with-microsoft-defender-threat-intelligence/3657379Tue, 11 Aug 2026 13:44:26 +0000Microsoft Defender XDR BlogSo you're interested in Microsoft Defender Threat Intelligence, but don't know where to start? Learn how to start a Premium trial or sign-up for Community...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/defender-ti-detections-in-microsoft-sentinel/3658961https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/defender-ti-detections-in-microsoft-sentinel/3658961Tue, 11 Aug 2026 13:44:25 +0000Microsoft Defender XDR BlogDid you know that you can benefit from Microsoft Defender Threat Intelligence if you're a Microsoft Sentinel customer? Come and learn how Microsoft Defender...https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-microsoft-defender-threat-intelligence-enables-threat-hunting-success/3647562https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-microsoft-defender-threat-intelligence-enables-threat-hunting-success/3647562Tue, 11 Aug 2026 13:44:19 +0000Microsoft Defender XDR BlogMicrosoft Defender Threat Intelligence (MDTI) is powerful in the hands of a threat hunter. In this blog, we’ll show you why.https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-internet-telemetry-data-becomes-threat-intelligence/3657881https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-internet-telemetry-data-becomes-threat-intelligence/3657881Tue, 11 Aug 2026 13:44:18 +0000Microsoft Defender XDR BlogSo how does Microsoft Defender Threat Intelligence collect, analyze, and index its raw public internet telemetry data? Check out this blog to learn more.