1.5 Mitigate Threats Using Microsoft Defender for Identity

Mitigate Threats Using Microsoft Defender for Identity

Introduction

Defender for Identity monitors on-premises Active Directory environments by analyzing traffic from domain controllers. It detects reconnaissance, credential theft, lateral movement, and domain dominance attacks that target Active Directory — the identity backbone of most enterprise environments.

This subsection teaches you what Defender for Identity detects, how its alerts appear in the XDR incident queue, and how to investigate and respond to identity-based threats. If your environment is cloud-only (Entra ID with no on-premises AD), Defender for Identity is less relevant — but most enterprise environments still have hybrid identity infrastructure.

What Defender for Identity detects

Defender for Identity sensors install on domain controllers and analyze authentication traffic, LDAP queries, DNS lookups, and replication requests. This gives it visibility into attack techniques that no other Defender product can see:

Investigation workflow for identity alerts

When an identity alert appears in the XDR incident:

1. Read the alert details — Defender for Identity provides a narrative explaining the detected behavior, the source device, the target accounts, and the MITRE ATT&CK mapping
2. Check the lateral movement path — the portal shows graphically how the attacker could move from the compromised account to high-value targets (domain admins)
3. Correlate with other products — did the identity alert coincide with an endpoint alert (malware running the credential theft tool) or an email alert (phishing that delivered the tool)?
4. Response actions — disable the compromised account in AD, force password reset, investigate the source device for the tool that performed the attack

1
2
3
4
5
6
7
8

// Investigate identity reconnaissance from Advanced Hunting
IdentityQueryEvents
| where Timestamp > ago(24h)
| where ActionType == "LDAP query"
| summarize QueryCount = count(), UniqueQueries = dcount(Query)
    by DeviceName, AccountUpn
| where QueryCount > 100
| order by QueryCount desc