Easily detect CVE-2024-21427 with Microsoft Defender for Identity

A recent CVE-2024-21427 Windows Kerberos Security Feature Bypass Vulnerability has been fixed to prevent the potential bypass of authentication policies configured in Active Directory. To ensure the latest protections are in place, the latest security updates, including the most recent patch, should be deployed to servers and devices. The Microsoft Defender for Identity team has added a new activity to the Advanced Hunting experience in the Defender portal that can assist in spotting possible attempts to exploit this vulnerability.

An advanced hunting activity has been added that monitors Kerberos AS authentication and can be used by customers to create their own custom detection rules within Microsoft Defender XDR to automatically trigger alerts for this activity. The tutorial includes information on monitoring Kerberos AS authentication and creating custom detection rules within Microsoft Defender XDR using the advanced hunting query and trigger alerts.

You can check the MSRC page for more information on this vulnerability and to stay up-to-date on the latest Defender for Identity capabilities, follow the "What's New" documentation page.