Listen to this Post
Introduction:
In the evolving landscape of identity-based attacks, security teams often face the challenge of fragmented user profiles across their environments. Microsoft Defender for Identity (MDI) offers a powerful, yet underutilized, manual feature to connect these dots proactively. By manually linking accounts to a single identity, you can transform your threat hunting and incident response, exposing lateral movement and persistence tactics that would otherwise go undetected.
Learning Objectives:
- Understand the critical security rationale behind manually linking user accounts in an identity security solution.
- Learn the step-by-step process to link accounts via the Microsoft Defender XDR portal and using PowerShell for automation.
- Gain actionable insights on how to use this capability for proactive threat hunting, hardening investigations, and mitigating attacker techniques like “account take-over” and “identity spoofing.”
You Should Know:
- The “Broken Identity” Problem: How Attackers Exploit Fragmented Profiles
In complex hybrid environments (Active Directory on-premises + Azure AD), a single human user often possesses multiple credentials. These can include a primary AD account, local admin accounts on servers, service account logins, and even test accounts. Defender for Identity typically auto-correlates these through behavior, but this process can be slow or incomplete. Attackers exploit this gap. By using a user’s secondary, less-monitored account, they can move laterally, access sensitive resources, and maintain persistence without triggering the consolidated timeline that would reveal their full attack chain.
Step-by-Step Guide:
Step 1: Access the Identity Page. Navigate to the Microsoft Defender XDR portal (security.microsoft.com). Go to Identities under the “Endpoints” section. This lists all entities MDI is monitoring.
Step 2: Investigate and Select the Primary Identity. Search for a known user (e.g., jdoe). Review their timeline. You might see alerts from their primary account but unrelated suspicious activities from another account (e.g., `svc_backup` or localadmin-jdoe).
Step 3: Initiate Manual Link. On the user’s identity profile page, click on the Manage account links option (often found in a dropdown menu). Here, you can search for and select other accounts observed in your environment that belong to the same person.
Step 4: Confirm and Justify. Link the accounts and provide a justification (e.g., “User’s known local admin account” or “Historical service account ownership”). This creates an audit trail.
- PowerShell Automation: Scaling Account Linking Across Your Tenant
Manually linking accounts for thousands of users is impractical. The MDI API, accessible via PowerShell, allows for automation and bulk operations, which is essential for large-scale deployments or onboarding new security policies.
Step-by-Step Guide:
Prerequisite: Install the required module and authenticate.
Install the Defender for Identity PowerShell module Install-Module -Name MicrosoftDefenderForIdentity Connect to your MDI instance (you'll need appropriate admin credentials) Connect-MDTIP -InstanceURL https://yourtenantname.atp.azure.com
Step 1: Prepare a CSV file. Create a file `accounts_to_link.csv` with columns: PrimaryAccount, SecondaryAccount, Reason.
PrimaryAccount,SecondaryAccount,Reason [email protected],CONTOSO\svc_sql_jdoe,Owned SQL service account [email protected],CONTOSO\jsmith_local,Documented local workstation admin
Step 2: Script the Bulk Linking.
Import the CSV and loop through each row
$links = Import-Csv -Path .\accounts_to_link.csv
foreach ($link in $links) {
New-MDTIPAccountLink -PrimaryAccount $link.PrimaryAccount -SecondaryAccount $link.SecondaryAccount -Reason $link.Reason
Write-Host "Linked $($link.SecondaryAccount) to $($link.PrimaryAccount)" -ForegroundColor Green
}
This script programmatically creates the links, ensuring consistency and saving significant manual effort.
3. Proactive Threat Hunting: Querying Linked Identity Data
Once accounts are linked, you can hunt for threats using Advanced Hunting in Microsoft 365 Defender, which incorporates MDI data.
Step-by-Step Guide:
Step 1: Craft a KQL Query. Look for sequences where activity jumps between a user’s linked accounts in a short timeframe, which could indicate compromised credential use.
// Advanced Hunting Query in Microsoft 365 Defender
IdentityLogonEvents
| where Timestamp > ago(7d)
| where AccountName in ("[email protected]", "CONTOSO\svc_sql_jdoe") // Use dynamic list from linked identities
| order by Timestamp asc
| project Timestamp, AccountName, DeviceName, ActionType, LogonType, RemoteIPAddress
Step 2: Analyze the Timeline. Execute the query. A result showing `[email protected]` logging into a workstation, immediately followed by `CONTOSO\svc_sql_jdoe` logging into a SQL server from that same workstation IP, warrants deep investigation into potential lateral movement.
4. Hardening Active Directory: The Source of Truth
Manual linking is a compensating control. The ultimate goal is to improve your directory hygiene. Use Active Directory PowerShell to identify potential candidates for linking.
Step-by-Step Guide:
Step 1: Discover Users with Multiple Service Accounts. On an AD management server, run:
This script finds users whose 'Description' field mentions a service account owner. Requires good AD documentation practices.
Get-ADUser -Filter -Properties Description | Where-Object {$_.Description -like "ownsserviceaccount"} | Select-Object SamAccountName, Description
Step 2: Audit Local Administrator Accounts. Use a tool like `BloodHound` or native PowerShell to enumerate local admin membership across computers, often revealing secondary accounts owned by IT staff. Correlate these findings with your MDI identity list.
- Mitigating Common Attack Techniques: Pass-the-Hash and Lateral Movement
A primary attack path involves using a compromised secondary account (often with higher privileges) to move laterally. Manual linking directly mitigates this by ensuring all activity under any of the user’s accounts is viewed as a single story.
Step-by-Step Guide:
Step 1: Simulate an Alert. An MDI alert “Suspicious lateral movement path” triggers for account svc_backup.
Step 2: Investigate with Links. You have previously linked `svc_backup` to primary user admin1. You now immediately see that admin1‘s primary account had a prior “Impossible travel” alert. This context tells you the attacker likely phished admin1, found `svc_backup` credentials, and is now moving. Without the link, these would be two separate, lower-priority investigations.
Step 3: Contain. Reset passwords for both linked accounts (admin1 and svc_backup) simultaneously and audit systems both accounts can access.
What Undercode Say:
- Key Takeaway 1: Manual account linking is not an administrative task but a critical threat intelligence aggregation tool. It transforms MDI from a passive alerting system into an active graph of human-centric behavior, closing the visibility gap attackers rely on.
- Key Takeaway 2: The true power is realized when combining manual links with automated hunting. This creates a feedback loop where hunting reveals accounts to link, and linking produces higher-fidelity hunting queries, continuously maturing your security posture.
Analysis:
This feature addresses a fundamental weakness in SIEM and XDR tools: correlation based solely on automated heuristics. By injecting human-domain knowledge (knowing which accounts belong to whom), security analysts drastically reduce the “mean time to understand” (MTTU) during an incident. It forces a shift from investigating machine-centric alerts to investigating people-centric attack chains. However, its effectiveness is gated by the quality of underlying asset and identity management. Organizations with poor documentation of service account ownership or local admin rights will struggle to implement this effectively. It serves as both a powerful security control and a metric for measuring identity hygiene maturity.
Prediction:
As identity becomes the primary attack vector, the manual curation of identity graphs will evolve into a standard, automated practice. We predict that within two years, ML models will not only suggest account links with high confidence but will also proactively simulate attacker movement using the linked graph to identify potential breach paths before they are exploited. Furthermore, integration with IT Service Management (ITSM) and Human Resources (HR) systems will auto-populate and validate these links upon employee onboarding/role change, making the identity security posture dynamic and inherently resilient. The manual “hack” of today will become the automated, policy-driven foundation of tomorrow’s identity-aware security platforms.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Fisherandrea Linkunlink – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
