Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Microsoft Defender for Identity classic security alerts

4 September 2026Doc update+13 / −7 lines

In brief

The alerts documentation now explains that some vulnerability alerts may still trigger after the relevant security update. When all affected systems are patched, applicable alerts have Low severity and may show patch status in the evidence. Documentation for Group Policy Tampering was also added.

What Defender admins need to know

Administrators can use alert severity and patch-status evidence to distinguish post-patch detections and review Group Policy Tampering alerts.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Defender for Identity classic alerts

To learn more about how to understand the structure, and common components of all Defender for Identity security alerts, see View and manage alerts.

Some vulnerability-related alerts can still trigger after you install the relevant security update because the activity matches a suspicious pattern. If every affected system has the update, applicable alerts have Low severity. Patch status appears in the evidence when the alert supports it. Review the alert, and use Microsoft Defender alert tuning rules only if you confirm that repeated activity is expected or benign.

Microsoft Defender for Identity classic alert categories

Defender for Identity security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links: |

Suspected Golden Ticket usage (time anomaly)
Previous name: Kerberos golden ticket.

Description:
Attackers with domain admin rights can compromise the KRBTGT account. Using the KRBTGT account, they can create a Kerberos ticket granting ticket (TGT) that provides authorization to any resource and set the ticket expiration to any arbitrary time. This fake TGT is called a "Golden Ticket" and allows attackers to achieve network persistence. This alert is triggered when a Kerberos ticket granting ticket is used for more than the allowed time permitted, as specified in the Maximum lifetime for user ticket.

Learning period: None

MITRE
- Primary MITRE tactic: Persistence (TA0003)
- Secondary MITRE tactic: Privilege Escalation (TA0004), Lateral Movement (TA0008)
- MITRE attack technique: Steal or Forge Kerberos Tickets (T1558)
- MITRE attack sub-technique: Golden Ticket(T1558.001)
|High|2022| |
Suspected skeleton key attack (encryption downgrade)
Previous name: Encryption downgrade activity.

Description:
Encryption downgrade is a method of weakening Kerberos using a downgraded encryption level for different fields of the protocol that normally have the highest level of encryption. A weakened encrypted field can be an easier target to offline brute force attempts. Various attack methods utilize weak Kerberos encryption cyphers. In this detection, Defender for Identity learns the Kerberos encryption types used by computers and users. The alert is issued when a weaker cypher is used that is unusual for the source computer, and/or user, and matches known attack techniques.
Skeleton Key is malware that runs on domain controllers and allows authentication to the domain with any account without knowing its password. This malware often uses weaker encryption algorithms to hash the user's passwords on the domain controller. In this alert, the learned behavior of previous KRB_ERR message encryption from domain controller to the account requesting a ticket, was downgraded.

Learning period: None

MITRE
- Primary MITRE tactic: Persistence (TA0003)
- Secondary MITRE tactic: Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210),Modify Authentication Process (T1556)
- MITRE attack sub-technique: Domain Controller Authentication (T1556.001)
|Medium|2010| |
Suspicious additions to sensitive groups
Description:
Attackers add users to highly privileged groups. Adding users is done to gain access to more resources, and gain persistency. This detection relies on profiling the group modification activities of users, and alerting when an abnormal addition to a sensitive group is seen. Defender for Identity profiles continuously.
For a definition of sensitive groups in Defender for Identity, see Working with sensitive accounts.
The detection relies on events audited on domain controllers. Make sure your domain controllers are auditing the events needed.

Learning period: Four weeks per domain controller, starting from the first event.

MITRE:
- Primary MITRE tactic: Persistence (TA0003)
- Secondary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Account Manipulation (T1098),Domain Policy Modification (T1484)
- MITRE attack sub-technique: N/A

Suggested steps for prevention:
- To help prevent future attacks, minimize the number of users authorized to modify sensitive groups.
- Set up Privileged Access Management for Active Directory if applicable.
|Medium|2024| |
Suspected Netlogon privilege elevation attempt (CVE-2020-1472 exploitation)
Description:
Microsoft published CVE-2020-1472 announcing that a new vulnerability exists that allows the elevation of privileges to the domain controller.
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), also known as Netlogon Elevation of Privilege Vulnerability.
The alert has Low severity when the relevant security update is installed on all domain controllers; otherwise, it has High severity.

Learning period: None

MITRE
- Primary MITRE tactic: Privilege Escalation (TA0004)
- MITRE attack technique: N/A
- MITRE attack sub-technique: N/A

Suggested steps for prevention:
- Review our guidance on managing changes in Netlogon secure channel connection which relate to and can prevent this vulnerability.
|High|High or Low|2411| |
Honeytoken user attributes modified
Description:
Every user object in Active Directory has attributes that contain information such as first name, middle name, last name, phone number, address, and more. Sometimes attackers try to manipulate these objects for their benefit, for example by changing the phone number of an account to get access to any multifactor authentication attempt. Microsoft Defender for Identity triggers this alert for any attribute modification against a preconfigured honeytoken user.

Learning period: None

MITRE
- Primary MITRE tactic: Persistence (TA0003)
- MITRE attack technique: Account Manipulation (T1098)
- MITRE attack sub-technique: N/A
|High|2427| |
Honeytoken group membership changed
Description:
In Active Directory, each user is a member of one or more groups. After gaining access to an account, attackers might attempt to add or remove permissions from it to other users, by removing or adding them to security groups. Microsoft Defender for Identity triggers an alert whenever there's a change made to a preconfigured honeytoken user account.

Learning period: None

MITRE
- Primary MITRE tactic: Persistence (TA0003)
- MITRE attack technique: Account Manipulation (T1098)
- MITRE attack sub-technique: N/A
|High|2428| |
Suspected SID-History injection
Description:
SIDHistory is an attribute in Active Directory that allows users to retain their permissions and access to resources when their account is migrated from one domain to another. When a user account is migrated to a new domain, the user's SID is added to the SIDHistory attribute of their account in the new domain. This attribute contains a list of SIDs from the user's previous domain.
Adversaries may use the SIH history injection to escalate privileges and bypass access controls. This detection triggers when newly added SID was added to the SIDHistory attribute.

Learning period: None

MITRE
- Primary MITRE tactic: Privilege Escalation (TA0004)
- MITRE attack technique: Account Manipulation (T1134)
- MITRE attack sub-technique: SID-History Injection(T1134.005)
|High|1106| |
Suspicious modification of a dNSHostName attribute (CVE-2022-26923)
Description:
This attack involves the unauthorized modification of the dNSHostName attribute, potentially exploiting a known vulnerability (CVE-2022-26923). Attackers might manipulate this attribute to compromise the integrity of the Domain Name System (DNS) resolution process, leading to various security risks, including man-in-the-middle attacks or unauthorized access to network resources.
The alert has Low severity when the required security update is installed on the destination; otherwise, it has High severity.
Learning period: None

MITRE
- Primary MITRE tactic: Privilege Escalation (TA0004)
- Secondary MITRE tactic: Defense Evasion (TA0005)
- MITRE attack technique: Exploitation for Privilege Escalation (T1068),Access Token Manipulation (T1134)
- MITRE attack sub-technique: Token Impersonation/Theft (T1134.001)
|High|High or Low|2421| |
Suspicious modification of domain AdminSdHolder
Description:
Attackers might target the Domain AdminSdHolder, making unauthorized modifications. This can lead to security vulnerabilities by altering the security descriptors of privileged accounts. Regular monitoring and securing of critical Active Directory objects are essential to prevent unauthorized changes.

Learning period: None

MITRE
- Primary MITRE tactic: Persistence (TA0003)
- Secondary MITRE tactic: Privilege Escalation (TA0004)
- MITRE attack technique: Account Manipulation (T1098)
- MITRE attack sub-technique: N/A
|High|2430| |
Suspicious Kerberos delegation attempt by a newly created computer
Description:
This attack involves a suspicious Kerberos ticket request by a newly created computer. Unauthorized Kerberos ticket requests can indicate potential security threats. Monitoring abnormal ticket requests, validating computer accounts, and promptly addressing suspicious activity are essential for preventing unauthorized access and potential compromise.
Learning period: None

MITRE
- Primary MITRE tactic: Defense Evasion (TA0005)
- Secondary MITRE tactic: Privilege Escalation (TA0004)
- MITRE attack technique: Domain Policy Modification (T1484)
- MITRE attack sub-technique: N/A
|High|2422| |
Suspicious Domain Controller certificate request (ESC8)
Description:
An abnormal request for a Domain Controller certificate (ESC8) raises concerns about potential security threats. This could be an attempt to compromise the integrity of the certificate infrastructure, leading to unauthorized access and data breaches.
Learning period: None

MITRE
- Primary MITRE tactic: Defense Evasion (TA0005)
- Secondary MITRE tactic: Persistence (TA0003),Privilege Escalation (TA0004),Initial Access (TA0001)
- MITRE attack technique: Valid Accounts (T1078)
- MITRE attack sub-technique: N/A
NOTE: Suspicious Domain Controller certificate request (ESC8) alerts are only supported by Defender for Identity sensors on AD CS.
|High|2432| |
Security principal reconnaissance (LDAP)
Description:
Security principal reconnaissance is used by attackers to gain critical information about the domain environment. Information that helps attackers map the domain structure, and identify privileged accounts for use in later steps in their attack kill chain. Lightweight Directory Access Protocol (LDAP) is one the most popular methods used for both legitimate and malicious purposes to query Active Directory. LDAP focused security principal reconnaissance is commonly used as the first phase of a Kerberoasting attack. Kerberoasting attacks are used to get a target list of Security Principal Names (SPNs), which attackers then attempt to get Ticket Granting Server (TGS) tickets for.
To allow Defender for Identity to accurately profile and learn legitimate users, no alerts of this type are triggered in the first 10 days following Defender for Identity deployment. Once the Defender for Identity initial learning phase is completed, alerts are generated on computers that perform suspicious LDAP enumeration queries or queries targeted to sensitive groups that using methods not previously observed.

Learning period: 15 days per computer, starting from the day of the first event, observed from the machine.

MITRE:
- Primary MITRE tactic: Discovery (TA0007)
- Secondary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Account Discovery (T1087)
- MITRE attack sub-technique: Domain Account (T1087.002)
Kerberoasting specific suggested steps for prevention:
- Require use of long and complex passwords for users with service principal accounts.
- Replace the user account by Group Managed Service Account (gMSA).
> Note:> Security principal reconnaissance (LDAP) alerts are supported by Defender for Identity sensors only.
|Medium|2038| |
Suspected Kerberos SPN exposure
Description:
Attackers use tools to enumerate service accounts and their respective SPNs (Service principal names), request a Kerberos service ticket for the services, capture the Ticket Granting Service (TGS) tickets from memory and extract their hashes, and save them for later use in an offline brute force attack.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Steal or Forge Kerberos Tickets (T1558)
- MITRE attack sub-technique: Kerberoasting (T1558.003)
|High|2410| |
Suspected AS-REP Roasting attack
Description:
Attackers use tools to detect accounts with their Kerberos preauthentication disabled and send AS-REQ requests without the encrypted timestamp. In response they receive AS-REP messages with TGT data, which may be encrypted with an insecure algorithm such as RC4, and save them for later use in an offline password cracking attack (similar to Kerberoasting) and expose plaintext credentials.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Steal or Forge Kerberos Tickets (T1558)
- MITRE attack sub-technique: AS-REP Roasting (T1558.004)

Suggested steps for prevention:
- Enable Kerberos preauthentication. For more information about account attributes and how to remediate them, see Unsecure account attributes.
|High|2412| |
Suspicious modification of a sAMNameAccount attribute (CVE-2021-42278 and CVE-2021-42287 exploitation)
Description:
An attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that isn't patched. This escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain.
When performing an authentication using Kerberos, Ticket-Granting-Ticket (TGT) and the Ticket-Granting-Service (TGS) are requested from the Key Distribution Center (KDC). If a TGS was requested for an account that couldn't be found, the KDC attemptS to search it again with a trailing $.
When processing the TGS request, the KDC fails its lookup for the requestor machine DC1 the attacker created. Therefore, the KDC performs another lookup appending a trailing $. The lookup succeeds. As a result, the KDC issues the ticket using the privileges of DC1$.
Combining CVEs CVE-2021-42278 and CVE-2021-42287, an attacker with domain user credentials can leverage them for granting access as a domain admin.
The alert has Low severity when the required security update is installed on the affected domain controller; otherwise, it has High severity.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Access Token Manipulation (T1134),Exploitation for Privilege Escalation (T1068),Steal, or Forge Kerberos Tickets (T1558)
- MITRE attack sub-technique: Token Impersonation/Theft (T1134.001)
|High|High or Low|2419| |
Honeytoken authentication activity
Previous name: Honeytoken activity.

Description:
Honeytoken accounts are decoy accounts set up to identify and track malicious activity that involves these accounts. Honeytoken accounts should be left unused while having an attractive name to lure attackers (for example, SQL-Admin). Any authentication activity from them might indicate malicious behavior.
For more information on honeytoken accounts, see Manage sensitive or honeytoken accounts.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- Secondary MITRE tactic: Discovery
- MITRE attack technique: Account Discovery (T1087)
- MITRE attack sub-technique: Domain Account (T1087.002)
|Medium|2014| |
Suspected DCSync attack (replication of directory services)
Previous name: Malicious replication of directory services.

Description:
Active Directory replication is the process by which changes that are made on one domain controller are synchronized with all other domain controllers. Given necessary permissions, attackers can initiate a replication request, allowing them to retrieve the data stored in Active Directory, including password hashes.
In this detection, an alert is triggered when a replication request is initiated from a computer that isn't a domain controller.
> Note:> If you have domain controllers on which Defender for Identity sensors aren't installed, those domain controllers aren't covered by Defender for Identity. When deploying a new domain controller on an unregistered or unprotected domain controller, it might not immediately be identified by Defender for Identity as a domain controller. It's highly recommended to install the Defender for Identity sensor on every domain controller to get full coverage.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- **Secondary MITRE tactic Persistence (TA0003)
- MITRE attack technique: OS Credential Dumping (T1003)
- MITRE attack sub-technique: DCSync (T1003.006)
Suggested steps for prevention::
Validate the following permissions:
- Replicate directory changes.
- Replicate directory changes all.
- For more information, see Grant Active Directory Domain Services permissions for profile synchronization in SharePoint Server 2013. You can use AD ACL Scanner or create a Windows PowerShell script to determine who in the domain has these permissions.
|High|2006| |
Suspected AD FS DKM key read
Description:
The token signing and token decryption certificate, including the Active Directory Federation Services (AD FS) private keys, are stored in the AD FS configuration database. The certificates are encrypted using a technology called Distribute Key Manager. AD FS creates and uses these DKM keys when needed. To perform attacks like Golden SAML, the attacker would need the private keys that sign the SAML objects, similarly to how the krbtgt account is needed for Golden Ticket attacks. Using the AD FS user account, an attacker can access the DKM key and decrypt the certificates used to sign SAML tokens. This detection tries to find any actors that try to read the DKM key of AD FS object.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Unsecured Credentials (T1552)<br - MITRE attack sub-technique: Unsecured Credentials: Private Keys (T1552.004)
|High|2413| |
Suspected DFSCoerce attack using Distributed File System Protocol
Description:
DFSCoerce attack can be used to force a domain controller to authenticate against a remote machine which is under an attacker's control using the MS-DFSNM API, which triggers NTLM authentication. This, ultimately, enables a threat actor to launch an NTLM relay attack.
Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Forced Authentication (T1187)
- :MITRE attack sub-technique:N/A
|High|2426| |
Suspicious Kerberos delegation attempt using BronzeBit method (CVE-2020-17049 exploitation)
Description:
Exploiting a vulnerability (CVE-2020-17049), attackers attempt suspicious Kerberos delegation using the BronzeBit method. This could lead to unauthorized privilege escalation and compromise the security of the Kerberos authentication process.
The alert has Low severity when the required security update is installed on the destination; otherwise, it has Medium severity.
Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Steal or Forge Kerberos Tickets (T1558)
- MITRE attack sub-technique: N/A
|Medium|Medium or Low|2048| |
Abnormal Active Directory Federation Services (AD FS) authentication using a suspicious certificate
Description:
Anomalous authentication attempts using suspicious certificates in Active Directory Federation Services (AD FS) might indicate potential security breaches. Monitoring and validating certificates during AD FS authentication are crucial for preventing unauthorized access.
Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- MITRE attack technique: Forge Web Credentials (T1606)
- MITRE attack sub-technique: N/A
> Note:> Abnormal Active Directory Federation Services (AD FS) authentication using a suspicious certificate alerts are only supported by Defender for Identity sensors on AD FS.
|High|2424| |
Suspected account takeover using shadow credentials
Description:
The use of shadow credentials in an account takeover attempt suggests malicious activity. Attackers may attempt to exploit weak or compromised credentials to gain unauthorized access and control over user accounts.
Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
-MITRE attack technique: OS Credential Dumping (T1003)
- MITRE attack sub-technique: N/A
|High|2431| |
Suspected suspicious Kerberos ticket request
Description:
This attack involves the suspicion of abnormal Kerberos ticket requests. Attackers might attempt to exploit vulnerabilities in the Kerberos authentication process, potentially leading to unauthorized access and compromise of the security infrastructure.

Learning period: None

MITRE:
- Primary MITRE tactic: Credential Access (TA0006)
- Secondary MITRE tactic: Collection (TA0009)
- MITRE attack technique: Adversary-in-the-Middle (T1557)
- MITRE attack sub-technique: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)
|High|2418| |
Suspected NTLM relay attack (Exchange account)
Description:
An Exchange Server computer account can be configured to trigger NTLM authentication with the Exchange Server computer account to a remote http server, run by an attacker. The server waits for the Exchange Server communication to relay its own sensitive authentication to any other server, or even more interestingly to Active Directory over LDAP, and grabs the authentication information.
Once the relay server receives the NTLM authentication, it provides a challenge that was originally created by the target server. The client responds to the challenge, preventing an attacker from taking the response, and using it to continue NTLM negotiation with the target domain controller.
In this detection, an alert is triggered when Defender for Identity identify use of Exchange account credentials from a suspicious source.

Learning period: None
MITRE:
- Primary MITRE tactic: Lateral Movement (TA0008)
- Secondary MITRE tactic: Privilege Escalation (TA0004)
- MITRE attack technique: Exploitation for Privilege Escalation (T1068), Exploitation of Remote Services (T1210), Man-in-the-Middle (T1557)
- MITRE attack sub-technique: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)

Suggested steps for prevention:
- Force the use of sealed NTLMv2 in the domain, using the Network security: LAN Manager authentication level group policy. For more information, see LAN Manager authentication level instructions for setting the group policy for domain controllers.
|Medium or Low if observed using signed NTLM v2 protocol|2037| |
Suspected overpass-the-hash attack (Kerberos)
Previous name: Unusual Kerberos protocol implementation (potential overpass-the-hash attack).

Description:
Attackers use tools that implement various protocols such as Kerberos and SMB in non-standard ways. While Microsoft Windows accepts this type of network traffic without warnings, Defender for Identity is able to recognize potential malicious intent. The behavior is indicative of techniques such as over-pass-the-hash, Brute Force, and advanced ransomware exploits such as WannaCry, are used.

Learning period: None
MITRE:
- **Primary MITRE tactic **: Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210),Use Alternate Authentication Material (T1550)
- MITRE attack sub-technique: Pass the Has (T1550.002), Pass the Ticket (T1550.003)
|Medium|2002| |
Suspected rogue Kerberos certificate usage
Description:
Rogue certificate attack is a persistence technique used by attackers after gaining control over the organization. Attackers compromise the Certificate Authority (CA) server and generate certificates that can be used as backdoor accounts in future attacks.

Learning period: None
MITRE:
- **Primary MITRE tactic **: Lateral Movement (TA0008)**Secondary MITRE tactic **: Persistence (TA0003), Privilege Escalation (TA0004)
- MITRE attack technique: N/A
- MITRE attack sub-technique: N/A
|High|2047| |
Suspected SMB packet manipulation (CVE-2020-0796 exploitation)
Description:
03/12/2020 Microsoft published CVE-2020-0796, announcing that a newly remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. Unpatched Windows servers are at risk from this vulnerability.
In this detection, a Defender for Identity security alert is triggered when SMBv3 packet suspected of exploiting the CVE-2020-0796 security vulnerability are made against a domain controller in the network.
The alert has Low severity when the required security update is installed on the destination; otherwise, it has High severity.

Learning period: None
MITRE:
- **Primary MITRE tactic : Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210)
- MITRE attack sub-technique: N/A

Suggested steps for prevention:
- If your have computers with operating systems that don't support KB4551762, we recommend disabling the SMBv3 compression feature in the environment, as described in the Workarounds section.
- Make sure all devices in the environment are up-to-date, and patched against CVE-2020-0796.
|High|High or Low|2406| |
Exchange Server Remote Code Execution (CVE-2021-26855)
Description:
Some Exchange vulnerabilities can be used in combination to allow unauthenticated remote code execution on devices running Exchange Server. Microsoft has also observed subsequent web shell implantation, code execution, and data exfiltration activities during attacks. This threat may be exacerbated by the fact that numerous organizations publish Exchange Server deployments to the internet to support mobile and work-from-home scenarios. In many of the observed attacks, one of the first steps attackers took following successful exploitation of CVE-2021-26855, which allows unauthenticated remote code execution, was to establish persistent access to the compromised environment via a web shell.
Adversaries may create authentication bypass vulnerability results from having to treat requests to static resources as authenticated requests on the backend, because files such as scripts and images must be available even without authentication.
The alert has Low severity when the relevant security update is installed on all domain controllers; otherwise, it has High severity.
Prerequisites:
Defender for Identity needs Windows Event 4662 to be enabled and collected to monitor for this attack. For information on how to configure and collect this event, see Configure Windows Event collection, and follow the instructions for Enable auditing on an Exchange object.
Learning period: None
MITRE:
- Primary MITRE tactic **: Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210)
- MITRE attack sub-technique: N/A

Suggested steps for prevention:
Update your Exchange servers with the latest security patches. The vulnerabilities are addressed in the March 2021 Exchange Server Security Updates.
|High|High or Low|2414| |
Suspected Brute Force attack (SMB)
Previous name: Unusual protocol implementation (potential use of malicious tools such as Hydra).

Description:
Attackers use tools that implement various protocols such as SMB, Kerberos, and NTLM in non-standard ways. While this type of network traffic is accepted by Windows without warnings, Defender for Identity is able to recognize potential malicious intent. The behavior is indicative of brute force techniques.

Learning period: None
MITRE:
- **Primary MITRE tactic **: Lateral Movement (TA0008)
- MITRE attack technique: Brute Force (T1110)
- MITRE attack sub-technique: Password Guessing (T1110.001), Password Spraying (T1110.003)

Suggested steps for prevention:
- Enforce Complex and long passwords in the organization. Complex and long passwords provide the necessary first level of security against future brute-force attacks.
- Disable SMBv1
|Medium|2033| |
Suspected WannaCry ransomware attack
Previous name: Unusual protocol implementation (potential WannaCry ransomware attack).

Description:
Attackers use tools that implement various protocols in non-standard ways. While this type of network traffic is accepted by Windows without warnings, Defender for Identity is able to recognize potential malicious intent. The behavior is indicative of techniques used by advanced ransomware, such as WannaCry.

Learning period: None
MITRE:
- **Primary MITRE tactic **: Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210)
- MITRE attack sub-technique: N/A

Suggested steps for prevention:
- Patch all of your machines, making sure to apply security updates.
- Disable SMBv1
|Medium|2035| |
Suspected use of Metasploit hacking framework
Previous name: Unusual protocol implementation (potential use of Metasploit hacking tools).

Description:
Attackers use tools that implement various protocols (SMB, Kerberos, NTLM) in non-standard ways. While this type of network traffic is accepted by Windows without warnings, Defender for Identity is able to recognize potential malicious intent. The behavior is indicative of techniques such as use of the Metasploit hacking framework.

Learning period: None
MITRE:
- **Primary MITRE tactic **: Lateral Movement (TA0008)
- MITRE attack technique: Exploitation of Remote Services (T1210)
- MITRE attack sub-technique: N/A
Suggested remediation and steps for prevention:
- Disable SMBv1
|Medium|2034| |
Suspicious deletion of the certificate database entries
Description:
The deletion of certificate database entries is a red flag, indicating potential malicious activity. This attack could disrupt the functioning of Public Key Infrastructure (PKI) systems, impacting authentication, and data integrity.
Learning period: None

MITRE:
- Primary MITRE tactic: Defense Evasion (TA0005)
- MITRE attack technique: Indicator Removal (T1070)- MITRE attack subtechnique: N/A
Note: Suspicious deletions of the certificate database entries alerts are only supported by Defender for Identity sensors on AD CS.
|Medium|2433| |
Suspicious disable of audit filters of AD CS
Description:
Disabling audit filters in AD CS can allow attackers to operate without being detected. This attack aims to evade security monitoring by disabling filters that would otherwise flag suspicious activities.
Learning period: None

MITRE:
- Primary MITRE tactic: Defense Evasion (TA0005)
- MITRE attack technique: Impair Defenses (T1562)
- MITRE attack subtechnique: Disable Windows Event Logging (T1562.002)
|Medium|2434| |
Directory Services Restore Mode Password Change
Description:
Directory Services Restore Mode (DSRM) is a special boot mode in Microsoft Windows Server operating systems that allows an administrator to repair or restore the Active Directory database. This mode is typically used when there are issues with the Active Directory and normal booting isn't possible. The DSRM password is set during the promotion of a server to a domain controller. In this detection, an alert is triggered when Defender for Identity detects a DSRM password is changed.
We recommend investigating the source computer and the user who made the request to understand if the DSRM password change was initiated from a legitimate administrative action or if it raises concerns about unauthorized access or potential security threats.
Learning period: None

MITRE:
- Primary MITRE tactic: Persistence (TA0003)- MITRE attack technique: Account Manipulation (T1098)- MITRE attack subtechnique: N/A
|Medium|2438| |
Group Policy Tampering
Description:
A suspicious change has been detected in Group Policy, resulting in the deactivation of Windows Defender Antivirus. This activity may indicate a security breach by an attacker with elevated privileges who could be setting the stage for distributing ransomware. Suggested steps for investigation:Understand if the GPO change is legitimate, If it wasn't, revert the change.Understand how the group policy is linked, to estimate its scope of impact.
Learning period: None

MITRE:
- Primary MITRE tactic:Defense Evasion (TA0005)- MITRE attack technique: Subvert Trust Controls (T1553)- MITRE attack subtechnique: N/A
|Medium|2440|