SOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
Edit

MDI (Identity)

Introduction

Microsoft Defender for Identity is a cloud-based security solution designed to protect on-premises and hybrid Active Directory environments from identity-based threats. It leverages behavioural analytics, machine learning, and advanced threat intelligence to detect suspicious activities, such as credential theft, lateral movement, and domain dominance. By analysing data collected from domain controllers, it identifies anomalies in user and entity behaviour, providing security teams with real-time alerts about potential compromises. Defender for Identity also helps organisations proactively secure their environments by identifying vulnerabilities, such as misconfigured accounts or exposed credentials.

Integrated with Microsoft's extended detection and response (XDR) suite, including tools like Microsoft 365 Defender and Azure Sentinel, Defender for Identity provides a unified view of identity-related security risks. It offers features such as lateral movement path analysis, which visualises potential attack routes, and advanced threat investigation tools to aid in incident response. This integration ensures comprehensive visibility and faster remediation across the enterprise. By focusing on protecting the backbone of IT infrastructure—identities—Microsoft Defender for Identity plays a crucial role in enhancing an organisation's overall security posture in a rapidly evolving threat landscape.

The following is a set of KQL queries that can be used to detect and analyse malicious or suspicious activities in your environment. The queries are designed to quickly grab the necessary information that will allow the investigator to determine whether the activity warrants deeper analysis or escalation.

Note: On some occasions, hopefully, at a minimum, the investigator will have to customise the queries for the environment where they are being used. Queries will only work if the data is available.

Devices Accessed By Compromised Device

Use Case: Query helpful for identifying lateral movement and suspicious activities stemming from the compromised device. It enables SOC analysts to correlate activity and prioritise mitigation steps effectively.

Defender 

// Define the compromised device and search window
let CompromisedDevice = "PC01.exampledomain.com";
let SearchWindow = 48h; // Customizable: h = hours, d = days

// Query to investigate devices accessed by the compromised device
IdentityLogonEvents
| where TimeGenerated >= ago(SearchWindow) // Use Sentinel's default time field
| where DeviceName == CompromisedDevice // Filter for the compromised device
| extend 
    FormattedTimestamp = format_datetime(TimeGenerated, 'yyyy-MM-dd HH:mm:ss'), // Human-readable timestamp
    AccessDetails = strcat(ActionType, " via ", Protocol) // Combine action type and protocol for detailed context
| summarize
    TotalAccessedDevices = dcount(DestinationDeviceName), // Count unique destination devices accessed
    AccessedDevices = make_set(DestinationDeviceName), // List of destination devices accessed
    AccountsUsed = make_set(AccountName), // List of accounts used in the access
    AccountDomains = make_set(AccountDomain), // List of account domains
    ActionsPerformed = make_set(ActionType), // List of unique action types
    ProtocolsUsed = make_set(Protocol), // List of unique protocols
    IPAddressesInvolved = make_set(IPAddress), // List of unique IP addresses involved
    TargetDevices = make_set(TargetDeviceName), // List of target devices
    AccessEventCount = count() // Total number of access events
    by bin(TimeGenerated, 1h), DeviceName // Group by time bins and device
| project 
    FormattedTimestamp, // Include formatted timestamp
    DeviceName, // Compromised device
    TotalAccessedDevices, // Number of unique devices accessed
    AccessedDevices, // List of accessed devices
    AccountsUsed, // List of accounts used
    AccountDomains, // List of account domains
    ActionsPerformed, // List of actions performed
    ProtocolsUsed, // List of protocols used
    IPAddressesInvolved, // List of IP addresses
    TargetDevices, // List of target devices
    AccessEventCount // Count of access events
| order by FormattedTimestamp desc // Sort by the most recent events

Identify All Suspicious Activities From The Compromised Accounts

Use Case: This query is useful for investigating potential lateral movement, unauthorised access, or malicious actions originating from compromised accounts. It provides actionable insights to guide further analysis and remediation.

Description: Use the SecurityEvent table to Identify all suspicious activities from the compromised accounts

Identify Failed Login Attempts From Users

Use Case: This query is ideal for monitoring failed login attempts in cloud environments where Azure AD is the authentication provider. It provides detailed insights into failed attempts, aiding in detecting brute force attacks or identifying suspicious login activity. Let me know if you need further adjustments! Failed login attempts for one or multiple user accounts from the SigninLogs table

A query using the IdentityLogonEvents table to identify failed login attempts with additional insights for investigation:

Use Case: This query is useful for identifying failed login attempts, understanding their context (e.g., IPs, devices, failure reasons), and detecting anomalies like brute force attacks or misconfigurations. It provides detailed and actionable information for investigation and remediation.

Lateral Movement By Compromised Accounts

Use Case: This query is tailored for detecting lateral movement by compromised accounts in your environment. By monitoring logon activity across devices, it helps identify patterns that could indicate attempts to expand access within the network.

User Added To Sensitive Group

Use Case: This query provides a detailed audit of group membership changes involving sensitive groups, including the initiator of the change and the added user. It is particularly useful for identifying unauthorized or suspicious changes in group memberships. Let me know if further refinements are needed!

Anomalous Group Policy Discovery

Use Case: This query is ideal for detecting: Unauthorised enumeration of Group Policies. Suspicious activity from new or unexpected devices, accounts, or IP addresses. Potential reconnaissance or pre-attack activity.

SMB File Copy

Use Case: This query detects SMB file copy events that are initiated by suspect accounts. It helps identify unauthorised file transfers, providing relevant details for further investigation.

Identify Suspicious SMB Activity

Reference

PreviousMDO (Office)NextMDE (Endpoint)

Last updated