Threat Analytics and Hunting Graphs

What it is

Hunting does not start from nothing. Threat analytics in Microsoft Defender XDR publishes reports on emerging threats, from ransomware campaigns to new vulnerabilities, and shows how exposed your organisation is. Hunting graphs add a visual way to hunt, by following the relationships between users, devices and other entities, and blast radius analysis shows how far an attacker could go from a compromised entity.

How it works

Threat analytics

Threat analytics is Microsoft's threat intelligence, delivered in the Defender portal as reports on threat actors, tools and techniques, and vulnerabilities. It helps you decide what to prioritise. The page shows a list of threats, with tags such as ransomware, phishing, nation state and vulnerability, and an indication of whether you have alerts for it.

Each report includes:

How to use it:

1. Review new reports regularly, or turn on threat analytics email notifications, so the right people are told when a new or updated report appears.
2. Check the related incidents and impacted assets to see whether the threat is already in your environment.
3. Check exposure and mitigations to see which devices are unprotected, and which configuration or patch closes the gap.
4. Run the hunting queries from the report, and adapt them to your environment.
5. Create custom detections from useful queries so the threat is caught automatically next time.

Threat analytics answers "should we worry about this threat, and are we exposed to it?", while advanced hunting answers "is it in our data?".

Graph based hunting

Tables are good at filtering, but attacks are about relationships: which user signed in to which device, which device can reach which server, which account holds a privilege. A graph shows these as nodes, such as users, devices and cloud resources, and edges, which are the relationships between them.

In the Defender portal, graph based hunting helps you:

• Traverse relationships between users, devices and other entities visually, by starting at one entity and expanding to those connected to it.
• Reveal privileged access paths to critical assets, such as a route from a user's laptop, through a service account, to a domain controller.
• Prioritise incidents and response by seeing which compromised entities are closest to your most important assets.
• Build a hunting graph from a query, for example the relationship between a compromised account and the devices it logged in to.

Use graph hunting when the question is about connections and reach, such as "which accounts with a path to our critical servers have been seen on a compromised device?". Use KQL when the question is about events and counts, such as "how many failed logons did we see?".

Blast radius analysis

Blast radius analysis is part of the incident graph in Defender. For an incident, it evaluates and visualises the vulnerable paths an attacker could take from a compromised entity to a critical asset. It answers "what could this compromise lead to?".

Typical use during an incident:

1. Open the incident graph and select a compromised user or device.
2. Run blast radius analysis to see the paths to critical assets, such as a database server or a privileged group.
3. Prioritise containment of the entities and paths that lead to the most valuable assets.
4. Close the paths, for example by removing excessive privileges or isolating a device.

Related capabilities support defence before a breach: attack path analysis in Microsoft Security Exposure Management and Defender for Cloud shows how an attacker could chain weaknesses to reach critical assets, so you can fix them in advance. Together, these let you move from reacting to anticipating.

Choosing the tool

A worked scenario

A new ransomware report appears in Threat analytics, and the SOC lead gets an email notification. The report shows that 40 devices are exposed because a mitigation is not applied, and that one related incident already exists. A hunter runs the report's hunting queries, finds suspicious activity on one server, and turns the query into a custom detection. During the related incident, the analyst opens the incident graph, runs blast radius analysis on the compromised account, and sees a path to a database server through a service account. The team isolates the server, removes the unneeded privilege and applies the mitigation from the report to the exposed devices.