New preview detection: Suspected NTLM authentication tampering

A few weeks ago, Microsoft published Security Advisory CVE-2019-1040, and announced discovery of a new tampering vulnerability in Microsoft Windows. Specifically, when “man-in-the-middle” attacks are able to successfully bypass NTLM MIC (Message Integrity Check) protection.

Attackers that successfully exploit this vulnerability have the ability to downgrade NTLM security features and successfully create authenticated session on behalf of other account. Unpatched Windows Servers are at risk from this vulnerability.

 

Starting from Version 2.86, Azure ATP detects NTLM authentication packets suspected of exploiting CVE-2019-1040 against a domain controller in the network, and issues a security alert like the one shown below.

 

For more information visit https://aka.ms/atasaguide-NTLMCVEexploit

 

Stay tuned for additional alerts and updates. As always, your questions and feedback are welcome!