Skip to main content

Defender for Identity

Introduction
Day 1: Deploy Microsoft Defender for Identity
Day 2: Attack, detect, and investigate. Exercise 1: Lab configuration
Day 2: Attack, detect, and investigate. Exercise 2: Reconnaissance and discovery alerts
Day 2: Attack, detect, and investigate. Exercise 3: Persistence and privilege escalation alerts
- 1. Suspicious additions to sensitive groups
- 2. Investigate a persistence and privilege escalation alert
Day 2: Attack, detect, and investigate. Exercise 4: Credential access alerts
Day 2: Attack, detect, and investigate. Exercise 5: Lateral movement alerts
- 1. Suspicious network connection over Encrypting File System Remote Protocol
- 2. Investigate a lateral movement alert
Day 2: Attack, detect, and investigate. Exercise 6: Other alerts

This site uses Just the Docs, a documentation theme for Jekyll.

TechExcel Defender for Identity

Day 2: Attack, detect, and investigate

Exercise 4: Credential access alerts

In this exercise, you’ll trigger and investigate a credentials access alert.

Table of contents

1. Security principal reconnaissance (LDAP)
2. Suspected DCSync attack (replication of directory services)
3. Honeytoken activity
4. Suspected Kerberos SPN exposure (Kerberoasting)
5. Investigate a credential access alert