Which Microsoft 365 Defender solution can detect an Active Directory domain compromise?

You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.

Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.

A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
B. Select Investigate files, and then filter App to Office 365.
C. Select Investigate files, and then select New policy from search.
D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
E. From Settings, select Information Protection, select Files, and then enable file monitoring.
F. Select Investigate files, and then filter File Type to Document.

A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
B. Select Investigate files, and then filter App to Office 365.
C. Select Investigate files, and then select New policy from search.
D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
E. From Settings, select Information Protection, select Files, and then enable file monitoring.
F. Select Investigate files, and then filter File Type to Document.

Microsoft Defender for Identity is a cloud-based security solution that can identify attack signals in Active Directory. The solution leverages traffic analytics and user behavior analytics on domain controllers and AD FS servers to prevent attacks by providing security posture assessments. Additionally, it helps expose vulnerabilities and lateral movement exploitation paths.

• Author
• Recent Posts

Brandon Lee has been in the IT industry 15+ years and focuses on networking and virtualization. He contributes to the community through various blog posts and technical documentation primarily at Virtualizationhowto.com.

Contents

1. Microsoft Defender for Identity architecture
2. Sensor requirements
3. Specific capabilities of Microsoft Defender for Identity
4. Proactive actioning of threat signals
5. Licensing
6. Wrapping up

Microsoft Defender for Identity has its roots in Azure, as well as in the former Advanced Threat Protection (Azure ATP). Therefore, organizations do not have to house the security solution on-premises aside from the sensor installed on the domain controllers. It is helpful to provide clear steps to resolve misconfigurations.

Microsoft Defender for Identity helps boost cybersecurity posture in the following four security pillars:

• Prevent—From the moment it's installed, it starts monitoring the Active Directory environment. This includes assessing the security configuration and AD schema. It provides recommendations on how to best protect the environment to prevent security from being compromised in the first place.
• Detect—It provides real-time analytics and data intelligence. This includes monitoring network activity, Windows events, and other metrics to provide real-time alerts to SecOps to provide the evidence needed to understand the threat and mitigate it effectively.
• Investigate—Provide user investigation priority scoring, activity events, and other contextual events to help SecOps understand what is happening in the environment to best respond.
• Respond—Automatic response to compromised identities. Automatically or semi automatically respond to threat alerts.

Microsoft Defender for Identity security pillars

One of the benefits of this cloud service is lifecycle management, and security intelligence is handled automatically by Microsoft. Microsoft Defender for Identity is updated weekly with the latest security intel, alerts, and security assessments.

The solution is also evolving in its capabilities and protected platforms. For example, Microsoft has extended the platform to include Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS). Now, organizations can deploy sensors to analyze threat signals related to their AD FS environments.

How does it fit in with other Microsoft cloud-driven products and solutions? Microsoft Defender for Identity is not an "end all be all" solution. However, it fits nicely with the layered approach, including:

• Application protection
• Endpoint protection
• Email and data protection

Layered security approach including Microsoft Defender for Identity

Microsoft Defender for Identity architecture ^

The Microsoft Defender for Identity architecture comprises the following:

1. Defender for Identity portal—Allows creating the Defender for Identity instance and displays the data received from the remote sensors. It is primarily where you will perform monitoring, management, and investigation activities.
2. Defender for Identity sensor—The remote threat signal collector that monitors network traffic and authentication requests.
3. Defender for Identity cloud service—The cloud service running in Azure infrastructure connected to Microsoft's intelligent security graph.

Microsoft Defender for Identity architecture

Sensor requirements ^

You can think of the sensor as the Microsoft Defender for Identity "agent." The requirements for it include the following:

• Server support—Windows Server 2008 R2 SP1 and higher
• .Net Framework 4.7
• Recommended hardware—6 GB RAM, 2 Cores
• Network ports—443 (outbound), DNS, NetLogon, RADIUS (internal) and NTLM, NetBIOS, and RDP on devices for Name Resolution
• Service account / Group Managed Service Account (read-only)
• Auditing events—4726, 4728, 4729, 4730, 4732, 4733, 4743, 4753, 4756, 4757, 4758, 4763, 4776, 7045, 8004

Specific capabilities of Microsoft Defender for Identity ^

What specific capabilities are provided by Microsoft Defender for Identity and integration with Microsoft 365 Security? Note the features below for detecting compromise and preventing lateral movement.

Reconnaissance

• Security principal enumeration (LDAP)
• User's group membership enumeration
• Users and IP address enumeration
• Host and server name enumeration (DNS)
• Resource access and suspicious activities
• Reconnaissance by targeted entity attributes

Credential access

• Brute force attempts (now also detected via AD FS)
• Suspicious VPN connections
• Honeytoken account suspicious activities
• Suspected AS-Rep roasting
• Logon/failed logon, and suspicious activities
• Suspected Kerberos SPN exposure
• Suspicious DC password change using NetLogon (CVE-2020-1472)

Lateral movement

• NTLM Relay and NTLM tampering
• Pass-the-Ticket
• Pass-the-Hash
• Overpass-the-Hash
• Suspicious group membership changes
• Suspicious SID history injection
• Suspected Pass-the-Certificate
• Suspicious rogue certificate

Persistence

• Golden ticket attack detection
• DCShadow, DCSync
• Data exfiltration detection
• Code execution/service creation on DC and AD FS
• SMB packet manipulation
• Skeleton key
• Golden ticket leveraging RBCD
• Suspicious print spooler registration
• Remote code execution attempt—Exchange server vulnerability (CVE-2021-26855)
• AD FS DKM read

Below is a screenshot of the user and IP address reconnaissance dashboard in Microsoft Defender for Identity:

User and IP address reconnaissance screen in Microsoft Defender for Identity courtesy of Microsoft

Proactive actioning of threat signals ^

Alerting and information about a potential attack are great. However, can Microsoft Defender for Identity proactively contain attacks? Yes, it can. Note the following containment actions provided by Microsoft Defender for Identity:

• Disable user—A compromised user account can be proactively disabled, preventing the user from logging into AAD/AD
• Revoke user sessions—The session/access token is automatically voided, and it prevents the user from refreshing the token
• Change/reset a user password—This action can change the user's password and force an account password change at the next login to AAD/AD
• Confirm the user as compromised—The user's risk level is set to "high" in the AAD IP

Licensing ^

Defender for Identity is available as part of Enterprise Mobility + Security E5/A5, Microsoft 365 E5/A5/G5, Microsoft 365 E5/A5/G5/F5 Security, Microsoft F5 Security & Compliance, and Microsoft Defender for Identity for Users. You can acquire a license directly from the Microsoft 365 portal or through the CSP program.

Wrapping up ^

As more attacks target Microsoft Active Directory and user credentials, protecting your Active Directory is crucial to the overall security posture of your organization.

Subscribe to 4sysops newsletter!

Microsoft Defender for Identity provides an interesting security solution for AD DS and AD FS that allows businesses to leverage Microsoft security intelligence to spot potential threats in the environment quickly and contain them.

Articles in series

Microsoft Defender

1. Mail flow reports in the Microsoft 365 Defender portal
2. Protect Active Directory with Microsoft Defender for Identity
3. Overview: Microsoft’s security portfolio under the Defender brand
4. Turn on Windows 10 Tamper Protection for Microsoft Defender
5. Setting up Microsoft Defender for Business with a simplified configuration
6. Windows Defender Application Control (WDAC): Secure Windows 10 / 11 against malicious apps and rogue drivers with recommended WDAC block rules
7. Configure attack surface reduction in Microsoft Defender using Group Policy or PowerShell
8. Manage Defender Antivirus using Intune
9. Configure Defender exploit protection using PowerShell and Group Policy
10. Microsoft Defender: Control updates for malware signatures using Group Policy or PowerShell
11. Configuring Defender Antivirus: Exclusions, real-time protection, scans, and remediations
12. Configuring Defender Exploit Guard network protection

Which two Microsoft cloud services can you integrate with the Microsoft Defender for identity implementation?

What is the difference between Defender ATP and azure ATP?

What is Microsoft Defender XDR?

What are the four categories of reporting found in the Microsoft 365 Defender Portal?