Inquire about searchings from Microsoft Defender Threat Intelligence

LMG 0 Reputation points
2023-05-12T07:21:55.7933333+00:00

When searching for our company domain in Microsoft Defender Threat Intelligence, 5,000 subdomains are displayed. In fact, our company has about 100 subdomains, but thousands of them come out, which is embarrassing. I would like to ask if someone simply querying for a subdomain will add up to the subdomain list, and can I guess what kind of malicious activity it is caused by?

ex) 0094e2e82e7445309c31f2d0af765b3f.mycompany.com
     f0832cc027f64e2b99944dab20b1e0f6.mycompany.com
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. David Broggy 5,701 Reputation points MVP
    2023-05-12T12:39:58.9666667+00:00

    Hi LMG,

    Since all publicly facing domains will be shared with many top level domain servers, it will be possible for attackers to obtain your full list of subdomains.

    The best approach to defending against vulnerabilities and unknown configuration of your servers is a combination of:

    Defender for Cloud - to keep an inventory of all of your cloud and on-prem servers (via Arc agent) and monitor/block misconfigurations.

    Defender for Endpoints/Servers - as your AV/EDR

    Defender for Endpoints/Servers - Vulnerability Management (E5 feature) - for identifying vulnerabilities on your assets.

    Defender for Endpoints/Servers - Application Control (E5 feature) - for an inventory of all applications and alerting/reporting/blocking of high risk applications.

    Defender EASM - For continuous tracking of all of your external assets.

    Microsoft Sentinel - Your SIEM for 'bringing it all together' and FINALLY providing your answer to the question 'given all my assets, are any of them vulnerable to attack AND are those potentially vulnerable assets CURRENTLY under attack?'

    0 comments