Skip to main content

Defender for Identity

Introduction
Day 1: Deploy Microsoft Defender for Identity
Day 2: Attack, detect, and investigate. Exercise 1: Lab configuration
Day 2: Attack, detect, and investigate. Exercise 2: Reconnaissance and discovery alerts
Day 2: Attack, detect, and investigate. Exercise 3: Persistence and privilege escalation alerts
- 1. Suspicious additions to sensitive groups
- 2. Investigate a persistence and privilege escalation alert
Day 2: Attack, detect, and investigate. Exercise 4: Credential access alerts
Day 2: Attack, detect, and investigate. Exercise 5: Lateral movement alerts
- 1. Suspicious network connection over Encrypting File System Remote Protocol
- 2. Investigate a lateral movement alert
Day 2: Attack, detect, and investigate. Exercise 6: Other alerts

This site uses Just the Docs, a documentation theme for Jekyll.

TechExcel Defender for Identity

Day 2: Attack, detect, and investigate

Exercise 6: Other alerts

In this exercise, you’ll trigger and investigate other alerts.

Table of contents

1. Data exfiltration over SMB
2. Remote code execution attempts
3. Investigate other alerts