ImpersonatedUserFootprint

Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack. Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally. This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.