New Defender for Identity security alerts
Analysis / inference: Microsoft Defender for Identity released new security alerts covering Entra ID, Active Directory threats including CVE-2025-33073, and Okta identity events.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft introduced new security alerts covering Entra ID sign-in anomalies via Temporary Access Pass, Active Directory Kerberos privilege escalation including diamond tickets and CVE-2025-33073, DPAPI master key requests, DNS data exfiltration, AD CS abuse patterns (ESC1, ESC8, ESC11), and multiple Okta identity provider anomalies.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisSOC analysts need visibility into newly released Microsoft Defender for Identity security alerts to ensure proper detection coverage for emerging Active Directory, Entra ID, and Okta attack techniques such as CVE-2025-33073 and AD CS abuse paths ESC1, ESC8, and ESC11.
Expands threat detection coverage across hybrid and multi-cloud identity environments, generating new security incidents that require SOC triage procedures.
Section 03 · Recommended actions
- Review the updated Microsoft Defender for Identity alert catalog to understand the context and severity of the new detections.
- Ensure integration pipelines mapping Defender for Identity alerts to Microsoft Sentinel or SIEM are operating correctly.
- Investigate any newly triggered alerts related to CVE-2025-33073 or AD CS certificate issuance abuse.
- Verify whether the newly introduced Microsoft Defender for Identity alerts are enabled and correctly forwarding incidents to Microsoft Sentinel or your SIEM.
- Review environment logs for indicators associated with CVE-2025-33073 exploitation attempts and diamond ticket creation.
- Audit Active Directory Certificate Services (AD CS) configurations for templates vulnerable to ESC1, ESC8, and ESC11.