Netwrix Innovation Week: Identity security innovations

A few small configuration changes, like a loosened conditional access policy or an edited user attribute, can turn a compromised Entra ID admin account into long-term access. The changes leave MFA on and nothing looks broken, so they're easy to miss. Catching them, along with the risky settings and service accounts around them, is what our product teams focused on in the latest updates to Netwrix Threat Manager and Netwrix PingCastle.

In a recent conversation with Joe Dibley, senior product manager for PingCastle, we dug into how attackers abuse Entra ID, how teams can get visibility into service accounts, and how both products are responding.

Explore every Innovation Week conversation to hear Netwrix and industry experts discuss data and identity security.

New Entra ID detections in Netwrix Threat Manager

The detections we're adding to Threat Manager include changes to the rules that govern Entra ID, such as longer token lifetimes, reduced auditing, and custom roles that can create backdoors. Those changes are a handful of events in a very large volume of logs, so they're practical to watch for. In all, we're adding more than 30 over the coming quarters, across four areas: control tampering, privilege escalation and persistence, credential attacks, and changes to applications and workload identities.

Dynamic group injection, one of the less common techniques in the set, shows how easy changes like this are to miss. Dynamic groups add members automatically based on an account attribute, so an attacker with edit access to an account can, for example, set its department to finance, join the finance group, and inherit everything that comes with it. The group itself never changes, so no approval step ever runs. Threat Manager already sees the attribute change, and we plan to enhance it to recognize when that change matches a dynamic group rule for a sensitive group or role.

A service accounts dashboard in Threat Manager

In the environments we work with, service accounts are usually overprivileged and sit outside MFA because they aren't human users. They often run on passwords that never expire, and because they authenticate programmatically, their logins get less attention than a person's.

The new service accounts dashboard in Threat Manager gives teams one view of every service account in their estate, with quick pivots into recent activity, threats, and weak encryption types. We identify them out of the box, and teams can add any we miss by naming convention or organizational unit.

Today the dashboard covers on-premises accounts, but service accounts exist just as much in Entra ID. The latest release already identifies agent identities there, and we plan to extend the dashboard to Entra ID so service principals, agent identities, and other non-human identities appear in one view.

PingCastle 4.0 adds an Entra ID risk assessment

The new assessment covers 102 risks, aimed at parity with our Active Directory assessment. Coverage includes hybrid setups, such as directory sync accounts with extended privileges, along with user consent settings, MFA methods, SharePoint sharing links, and Azure Key Vault configuration.

Each risk has its own definition file, so our threat research team can prototype in JSON, and customers can see how a risk changes between versions, edit it, or release their own.

Threat research behind both products

Both products draw on the same source. Our threat research team studies real-world attacks and the techniques used against Entra ID, and Joe and I each work with them regularly to prioritize what goes into future versions.

Our security research newsletter, Threat Lab Quarterly, gives you a way to follow that work. Each issue covers what the team is tracking and what it could mean for defenders. The first edition is out now.

Innovation Week at Netwrix

Netwrix Innovation Week runs October 19 to 23 and brings technical experts and defenders together for deep dives into identity and data security. The week includes video interviews, demos, livestreams, an expert panel, and an AI-based capture the flag challenge.