defender-for-identity

Name: defender-for-identity
Author: vinayaklatthe

56installs34forks

How to install defender-for-identity?

vinayaklatthe/microsoft-security-skills/defender-for-identity

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-identity

Installs into the current project.

Summary

Guidance for Microsoft Defender for Identity (MDI) — identity threat detection (ITDR) across on-premises Active Directory, AD CS, AD FS, and Entra Connect using sensors. Covers sensor placement, prerequisites, posture assessments, and lateral-movement detection. WHEN: Defender fo

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Identity
2
3	Microsoft Defender for Identity (MDI) is a cloud-based identity threat detection and response
4	(ITDR) solution. Lightweight sensors on domain controllers and other identity infrastructure
5	parse network traffic, ETW events, and AD object reads to detect reconnaissance, credential
6	theft, lateral movement, and domain dominance. Signals correlate into Defender XDR incidents.
7
8	## When to use
9	Detecting identity-based attacks against on-premises Active Directory, AD CS, AD FS,
10	and Entra Connect — and surfacing identity posture issues (legacy protocols, unsecure
11	accounts, risky delegations) that lead to those attacks.
12
13	Do not use this skill for cloud-only Entra ID risk detection — that is **Entra ID
14	Protection** (`entra-id-protection`). MDI sees on-prem and hybrid identity infrastructure.
15
16	## Map the attack to a detection source
17
18	Pick the row that matches the attacker behaviour to confirm MDI is the right control and
19	which sensor surface produces the signal.
20
21	\| If the attacker is... \| MDI detection family \| Sensor surface \|
22	\|---\|---\|---\|
23	\| Enumerating users, groups, SPNs \| Reconnaissance \| DC sensor (LDAP, SAMR) \|
24	\| Cracking service-account TGS tickets offline \| Kerberoasting \| DC sensor (Kerberos) \|
25	\| Replicating directory secrets (DCSync) \| Domain dominance \| DC sensor (DRSUAPI RPC) \|
26	\| Forging Kerberos tickets \| Golden / Silver Ticket \| DC sensor (Kerberos anomalies) \|
27	\| Abusing AD CS misconfig (ESC1–ESC8) \| Certificate-based privilege escalation \| AD CS sensor \|
28	\| Hijacking the AD FS sign-in flow \| Token / SAML forgery \| AD FS sensor \|
29	\| Stealing Entra Connect sync account creds \| Hybrid identity compromise \| Entra Connect sensor \|
30	\| Probing risky configurations (legacy SMB, weak SPNs) \| Identity Security Posture (ISPM) \| All sensors + cloud assessments \|
31
32	> Rule of thumb: if the attacker touches an on-prem identity service for any step, MDI
33	> should see it. A gap in any sensor (one un-instrumented DC, AD CS, or AD FS) is a blind
34	> spot for the whole kill chain.
35
36	## Approach
37
38	1. Map identity infrastructure — Inventory every domain controller (including RODCs),
39	every AD CS Enterprise CA, every AD FS server, and every Entra Connect / Cloud Sync host.
40	This list is the sensor target list — gaps here become attack paths later.
41	Verify: `Get-ADDomainController -Filter ` count equals the deployed sensor count in the
42	MDI portal under Settings → Sensors.*
43
44	2. Confirm prerequisites before deploy — Each sensor host needs outbound HTTPS to the MDI
45	cloud service, the MDI sensor MSI, a Directory Service Account (DSA), and (on DCs) the
46	Advanced Audit Policy settings + Object Access SACLs that MDI requires.
47	Verify: run the MDI sizing tool* and confirm CPU/RAM headroom; sensors should add
48	< 10% sustained CPU on a DC.*
49
50	3. Use a gMSA for the Directory Service Account — Group Managed Service Accounts rotate
51	passwords automatically and remove the worst class of credential exposure. Never use a
52	plaintext-password service account.
53	*Verify: `Get-ADServiceAccount mdi-gmsa$ -Properties PrincipalsAllowedToRetrieveManagedPassword`
54	returns the sensor host group, nothing wider.*
55
56	4. Deploy sensors in waves — DC sensors first (highest signal), then AD CS, AD FS, Entra
57	Connect. Wait 24 hours between waves to baseline traffic and avoid drowning the SOC in
58	first-time-seen activity alerts.
59
60	5. Tune alerts, then act on posture — Acknowledge benign first-week alerts (admin tooling
61	noise), then work the Identity Security Posture Assessments (Secure Score panel). Posture
62	issues (e.g. Unsecure account attributes, Legacy protocols, Dormant accounts) are the
63	weak links attackers exploit before alerts ever fire.
64	Verify: posture score baseline captured at week 1; track delta monthly, not daily.
65
66	6. Deploy honeytokens — Plant 1-2 fake high-privilege accounts (e.g. `svc-legacy-backup`)
67	that no human should ever touch. Any auth attempt is high-confidence malicious.
68
69	7. Correlate in Defender XDR — MDI alerts auto-correlate with MDE and Entra ID Protection
70	into a single

People who liked this also viewed

6 picks

Type

defender-for-identity

56installs34forks

View on GitHub

How to install defender-for-identity?

vinayaklatthe/microsoft-security-skills/defender-for-identity

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-identity

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Identity
2
3	Microsoft Defender for Identity (MDI) is a cloud-based identity threat detection and response
4	(ITDR) solution. Lightweight sensors on domain controllers and other identity infrastructure
5	parse network traffic, ETW events, and AD object reads to detect reconnaissance, credential
6	theft, lateral movement, and domain dominance. Signals correlate into Defender XDR incidents.
7
8	## When to use
9	Detecting identity-based attacks against on-premises Active Directory, AD CS, AD FS,
10	and Entra Connect — and surfacing identity posture issues (legacy protocols, unsecure
11	accounts, risky delegations) that lead to those attacks.
12
13	Do not use this skill for cloud-only Entra ID risk detection — that is **Entra ID
14	Protection** (`entra-id-protection`). MDI sees on-prem and hybrid identity infrastructure.
15
16	## Map the attack to a detection source
17
18	Pick the row that matches the attacker behaviour to confirm MDI is the right control and
19	which sensor surface produces the signal.
20
21	\| If the attacker is... \| MDI detection family \| Sensor surface \|
22	\|---\|---\|---\|
23	\| Enumerating users, groups, SPNs \| Reconnaissance \| DC sensor (LDAP, SAMR) \|
24	\| Cracking service-account TGS tickets offline \| Kerberoasting \| DC sensor (Kerberos) \|
25	\| Replicating directory secrets (DCSync) \| Domain dominance \| DC sensor (DRSUAPI RPC) \|
26	\| Forging Kerberos tickets \| Golden / Silver Ticket \| DC sensor (Kerberos anomalies) \|
27	\| Abusing AD CS misconfig (ESC1–ESC8) \| Certificate-based privilege escalation \| AD CS sensor \|
28	\| Hijacking the AD FS sign-in flow \| Token / SAML forgery \| AD FS sensor \|
29	\| Stealing Entra Connect sync account creds \| Hybrid identity compromise \| Entra Connect sensor \|
30	\| Probing risky configurations (legacy SMB, weak SPNs) \| Identity Security Posture (ISPM) \| All sensors + cloud assessments \|
31
32	> Rule of thumb: if the attacker touches an on-prem identity service for any step, MDI
33	> should see it. A gap in any sensor (one un-instrumented DC, AD CS, or AD FS) is a blind
34	> spot for the whole kill chain.
35
36	## Approach
37
38	1. Map identity infrastructure — Inventory every domain controller (including RODCs),
39	every AD CS Enterprise CA, every AD FS server, and every Entra Connect / Cloud Sync host.
40	This list is the sensor target list — gaps here become attack paths later.
41	Verify: `Get-ADDomainController -Filter ` count equals the deployed sensor count in the
42	MDI portal under Settings → Sensors.*
43
44	2. Confirm prerequisites before deploy — Each sensor host needs outbound HTTPS to the MDI
45	cloud service, the MDI sensor MSI, a Directory Service Account (DSA), and (on DCs) the
46	Advanced Audit Policy settings + Object Access SACLs that MDI requires.
47	Verify: run the MDI sizing tool* and confirm CPU/RAM headroom; sensors should add
48	< 10% sustained CPU on a DC.*
49
50	3. Use a gMSA for the Directory Service Account — Group Managed Service Accounts rotate
51	passwords automatically and remove the worst class of credential exposure. Never use a
52	plaintext-password service account.
53	*Verify: `Get-ADServiceAccount mdi-gmsa$ -Properties PrincipalsAllowedToRetrieveManagedPassword`
54	returns the sensor host group, nothing wider.*
55
56	4. Deploy sensors in waves — DC sensors first (highest signal), then AD CS, AD FS, Entra
57	Connect. Wait 24 hours between waves to baseline traffic and avoid drowning the SOC in
58	first-time-seen activity alerts.
59
60	5. Tune alerts, then act on posture — Acknowledge benign first-week alerts (admin tooling
61	noise), then work the Identity Security Posture Assessments (Secure Score panel). Posture
62	issues (e.g. Unsecure account attributes, Legacy protocols, Dormant accounts) are the
63	weak links attackers exploit before alerts ever fire.
64	Verify: posture score baseline captured at week 1; track delta monthly, not daily.
65
66	6. Deploy honeytokens — Plant 1-2 fake high-privilege accounts (e.g. `svc-legacy-backup`)
67	that no human should ever touch. Any auth attempt is high-confidence malicious.
68
69	7. Correlate in Defender XDR — MDI alerts auto-correlate with MDE and Entra ID Protection
70	into a single

People who liked this also viewed

6 picks

Type