A security team is analyzing a series of alerts generated by Microsoft Defender for Identity related to potential credential theft. They observe multiple instances of 'Kerberos ticket requested with unusual encryption type' (Event ID 4769). To investigate these alerts effectively, which KQL table in Advanced Hunting should they primarily query to find detailed information about these specific Kerberos tickets?
- AIdentityQueryEvents
- BIdentityLogonEvents
- CIdentityDirectoryEvents
- DIdentityInfo
Show answer & explanationAnswer & explanation
Correct answer: B. IdentityLogonEvents
The 'IdentityLogonEvents' table in Advanced Hunting specifically captures information related to logon activities, including Kerberos authentications (Event ID 4769). It contains details like the account name, device name, and relevant Kerberos fields (e.g., 'Protocol', 'LogonType', 'KerberosEncryptionType') that are crucial for investigating 'unusual encryption type' alerts.
Why the other options are wrong
- A. IdentityQueryEvents tracks LDAP/DNS queries, not Kerberos ticket requests.
- C. IdentityDirectoryEvents focuses on Active Directory object changes, not Kerberos ticket requests.
- D. IdentityInfo provides static information about identities, not dynamic logon events.
KQL: IdentityLogonEvents for Kerberos
The `IdentityLogonEvents` table in Microsoft Defender XDR Advanced Hunting is the primary source for detailed information on Kerberos authentication events (including Event ID 4769), providing insights into encryption types, account names, and device context.
- Captures Kerberos ticket request events (4769).
- Contains 'KerberosEncryptionType' and other relevant fields.
- Crucial for investigating Kerberos-related credential theft.
Memory trick: For Kerberos tickets, you need 'LogonEvents' – that's where all the authentication details, including encryption types, are stamped.