RECENTDetection updateAction required
Easily detect CVE-2024-21427 Windows Kerberos Security Feature Bypass Vulnerability
Analysis / inference: Microsoft Defender for Identity added a new Advanced Hunting capability and KQL query to detect CVE-2024-21427 Kerberos authentication bypass attempts.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft released an Advanced Hunting KQL query leveraging IdentityLogonEvents to surface Kerberos AS authentication anomalies and resource access patterns related to CVE-2024-21427.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisWhy it matters
Provides SOC analysts with a targeted Advanced Hunting query in Microsoft Defender XDR to identify exploitation attempts targeting CVE-2024-21427.
Operational impact
Enables security teams to write custom detection rules in Defender XDR using specialized Kerberos protocol fields and AdditionalFields parameters.
Section 03 · Recommended actions
- Navigate to Microsoft Defender portal -> Hunting -> Advanced Hunting.
- Copy and evaluate the provided KQL query for IdentityLogonEvents.
- Customize the query to filter out noise such as unrelated failed logons before creating custom detection rules.
What to check
- Review the provided KQL query against IdentityLogonEvents for Active Directory Kerberos AS authentication attempts.
- Inspect DestinationDC, Spns, and LogonType values for potential security feature bypass indicators.
Affected scope
ProductsDefender for Identity