Microsoft just added 18 new security alerts to Defender for Identity in the October 2026 release, one of the bigger alert drops I’ve seen in a while. Breakdown of what matters: 🔹CVE-2025-33073 exploitation: dedicated detection for this specific Kerberos relay vulnerability. If you haven’t patched yet, this gives you a compensating detective control in the meantime. 🔹AD CS certificate abuse (3 new alerts): native coverage for ESC1, ESC8, and ESC11 misconfigured template and issuance abuse paths. These are well-worn red team techniques finally getting first-party detection. 🔹Suspicious sign-in via Temporary Access Pass: TAP is meant for MFA bootstrapping and account recovery, but it’s also a known persistence/bypass technique when abused. Good to see this covered. 🔹DPAPI master key theft + DNS-based data exfiltration: two common post-compromise techniques that signature based tools routinely miss. 🔹First real wave of Okta-specific alerts (7 total): token theft, MFA method tampering, privileged account auth anomalies, consent-grant abuse, and more. If you’re running hybrid Entra/Okta, this closes a real visibility gap MDI didn’t have before. These roll out automatically, no config changes needed, worth checking your alert dashboard to confirm you’re seeing them. Full list: learn.microsoft.com/en-us/de… #MicrosoftSecurity #DefenderForIdentity #IdentityThreatDetection