Compromised identities surfaced by Microsoft Defender for Identity have been remediated

Overview

When Microsoft Defender for Identity raises an alert that a user account has been compromised — for example through Pass-the-Hash, Pass-the-Ticket, suspicious sign-in from an exposed credential, or stolen access — the account stays under the threat actor’s control until it is disabled, its password is reset, and any active sessions are revoked. While the account remains active, the threat actor can continue lateral movement to sensitive servers, request additional Kerberos tickets, dump credentials from more endpoints, and persist by registering a new authentication method or creating a mail forwarding rule. Microsoft Defender for Identity flags the impacted user and surfaces containment actions in Microsoft Defender XDR; this check confirms there are no open identity alerts whose subject account has not yet been remediated, so the kill chain is closed at the credential stage rather than allowed to advance to data access.

Remediation

• Investigate identities in Microsoft Defender XDR
• Microsoft Defender for Identity remediation actions
• Investigate alerts in Microsoft Defender XDR
• Investigate risk with Microsoft Entra ID Protection

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Medium
Pillar	SecOps
Category	Identity threat protection
Product	Defender
Feature	Defender for Identity
Area	Logging and detection
ATT&CK	T1078.002 Domain Accounts, T1550.002 Pass the Hash, T1550.003 Pass the Ticket
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.