L4. Defender for Identity: Lateral Movement Detection

What Is Defender for Identity?

Microsoft Defender for Identity (MDI) monitors on-premises Active Directory traffic to detect identity-based threats. It captures and analyzes network traffic to and from domain controllers, detecting attacks like pass-the-hash, pass-the-ticket, Kerberoasting, and DCSync.

MDI feeds its alerts into Defender XDR, where they are correlated with endpoint, email, and cloud app signals.

Sensor Deployment

MDI uses sensors installed directly on domain controllers (or on standalone servers in older deployments):

The sensor captures network traffic, Windows events (4776, 8004, and others), and ETW traces. It forwards parsed data to the MDI cloud service for analysis. Exam tip: The domain controller sensor is the recommended deployment model. Standalone sensors require port mirroring configuration, which adds complexity.

Key Detection Categories

MDI detections map to the MITRE ATT&CK framework: Reconnaissance:

• Account enumeration (LDAP, SAM-R)
• Network mapping scans
• DNS enumeration

Credential access:

• Kerberoasting (requesting service tickets for offline cracking)
• AS-REP Roasting (targeting accounts without pre-authentication)
• Brute force authentication attempts
• Suspicious authentication failures

Lateral movement:

• Pass-the-hash and pass-the-ticket attacks
• Overpass-the-hash (using NTLM hash to obtain Kerberos tickets)
• Remote code execution attempts
• Suspicious use of administrative protocols

Domain dominance:

• DCSync attacks (replicating directory data)
• Golden Ticket usage (forged Kerberos TGTs)
• Skeleton Key malware
• DCShadow attacks

Lateral Movement Paths

The Lateral Movement Paths (LMP) feature maps how an attacker could move from a compromised account to high-value targets like Domain Admins. It visualizes:

1. Which accounts have sessions on which devices
2. Which accounts have local admin rights on which devices
3. Group memberships that grant access to sensitive resources

Use LMP to proactively identify and remediate overly permissive access before an attacker exploits it. Exam tip: Lateral Movement Paths are a proactive security posture tool, not just a detection feature. The exam may ask about using LMP to reduce attack surface.

Security Posture Assessments

MDI evaluates your Active Directory configuration and reports issues like:

• Accounts with cleartext passwords in Group Policy preferences
• Dormant accounts with privileged access
• Unsecured Kerberos delegation configurations
• Accounts exposing credentials in cleartext LDAP binds

These assessments appear as recommendations in Microsoft Secure Score.

Entity Pages

Every user and device monitored by MDI gets an entity page showing:

• Alert timeline
• Active Directory group memberships
• Lateral movement paths involving this entity
• Logon activity and resource access patterns