Microsoft Defender for Identity Adds More Certificate Abuse Detections -- Redmondmag.com

Microsoft Defender for Identity Adds More Certificate Abuse Detections

By Kurt Mackie
08/16/2023

Microsoft Defender for Identity now has a new sensor to further detect certificate abuses by attackers, per a Wednesday announcement.

The new sensor gets deployed on Active Directory Certificate Services (ADCS) servers, and will deliver alerts and recommendations to IT pros through Microsoft's Secure Score dashboard. It can detect when attackers "relay NTLM authentication to ADCS" for impersonation purposes. It'll flag ADCS log configuration changes, including disablement, which is done to cover attacker activities. IT pros also get alerted about deletion of certificate requests, another tactic used by attackers to obscure their actions.

Microsoft is planning to add the ability to detect ADCS modifications, too, such as changes made to the access control list, which can give attackers the ability to "perform certificate authority level operations that potentially can lead to domain takeover."

ADCS "is not a default element of every AD instance," Microsoft explained. However, when it's used, it turns out to be a prime target for attackers. ADCS is a Windows Server role that's used "to create and manage public key infrastructure (PKI) certificates," the announcement explained.

The certificates created by ADCS can serve as password equivalents, the announcement added:

These certificates are used to establish trusted and secure communication between users, devices, and applications on a network or, more importantly for this discussion, as password- equivalents for user authentication.

Moreover, ADCS "can be extremely easy to misconfigure," making it a "ripe target" for attackers.

Back in February, Microsoft had described how Microsoft Defender for Identity has sensors to detect an attack using a suspicious certificate over the Kerberos protocol. It also advised organizations to secure ADCS against "many various potential abuses and misconfigurations."

Here was Microsoft advice back in February for hardening environments against ADCS abuses:

Treat your AD CS servers as tier-0 assets. They are as important as Domain Controllers.
Harden your AD CS servers against ESC8 technique, according to this advisory.
Reduce attack surface. If possible, disable unused certificate templates and enrollment permissions.
Monitor certificate enrollments in your organization, to have further visibility on AD CS operations.

Organizations need to assure that they are collecting the required events to see the new Secure Score alerts about ADCS abuse. "To view the new alerts and Secure Score reports, make sure that the required events are being collected and logged on your server," Microsoft indicated in its "What's New in Microsoft Defender for Identity" document.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.