Attack Paths in Microsoft Defender

Issue #11: 24 December 2025

What are attack paths?

Modern cyber attacks rarely consist of a single step. Attackers continuously look for the path of least resistance within a network: a chain of weak links that lets them push through from a simple entry point to crown jewels such as domain controllers or sensitive data. Such a chain of opportunities is known as an attack path. Every individual misconfiguration or overly broad access right looks harmless, but together they can form a route for an attacker to move laterally and escalate their privileges step by step.

Understanding and eliminating these attack paths is crucial: research emphasises that proactively identifying and addressing attack paths is one of the most effective strategies to prevent major data breaches.

In this deep dive we discuss what attack paths are and how they arise in a Microsoft 365 environment. We then analyse the technical details: which Microsoft Defender capabilities such as Attack Surface Reduction and Threat Analytics help detect or prevent lateral movement, illustrated with scenarios and MITRE ATT&CK references. After that we move on to solutions and best practices: how to configure Microsoft Defender and your environment to mitigate attack paths, and how integration with Secure Score contributes to structurally better security.

In short: you learn not only why attack paths are so dangerous, but above all how to find and block them with the right tools and configurations. Let us start with how the problem arises.

How do attack paths arise in Microsoft 365 environments?

Even in well-managed environments, unnoticed combinations of rights and resources can form an attack path. Some typical causes in a Microsoft 365 (and hybrid AD) environment:

• Reused or stored credentials: an admin who logs on with their administrator account on a regular workstation leaves credentials behind there. An attacker who compromises that PC finds the admin hash in memory or in the cache and can jump further to server or domain level (the classic Pass-the-Hash scenario). This is reinforced when the same local admin password is used everywhere: compromise one machine and you have admin access on all machines afterwards.
• Excessive permissions & group memberships: users who remain members of old (sensitive) groups, or service accounts with too high privileges. An attacker who gets hold of such an account immediately inherits many access rights. Lateral movement paths often arise because a non-sensitive user can indirectly gain access to sensitive accounts through shared groups or machines. For example: user A is local admin on PC1; admin B once logs in on PC1; now there is a path from A's account to B's admin rights via PC1. Such relationships can be hard to see through in complex Microsoft 365/AD environments without the right tools.
• Availability of internal services to all clients: by default Windows clients can reach each other via protocols such as SMB (file sharing) or WMI. Attackers abuse this: once inside, from one compromised machine they aggressively scan around and connect to others (e.g. via SMB for lateral movement or to copy tools). If there is no strict internal segmentation or firewalling, an attacker moves almost unhindered from one PC to the next.
• Lack of multi-factor and legacy protocols: in the Microsoft 365 cloud context we see attack paths also arise through weak identity hygiene. For example: a user without MFA who falls victim to phishing: the attacker then has a valid cloud token. Via legacy protocols (which do not require MFA, such as old POP/IMAP) they can access other services with it. Or imagine: a leaked user login that happened to keep global admin rights "just in case". These are paths that are easy for attackers to abuse and often stay under the radar.

In summary, attack paths arise through access that 'leaks' uncontrolled from low to high: stored passwords, shared local admins, too-open network connections, or accounts with more rights than strictly necessary. Microsoft 365 and hybrid environments have many interdependencies, which lets a single weak spot spread to other parts. The challenge is getting visibility into these hidden paths before an attacker finds them. This is where the advanced features of Microsoft Defender come into view.

A seemingly innocent user account can be the first link in a chain towards an admin account.

Technical analysis of attack paths and defence

In this section we analyse how the Microsoft security stack identifies and blocks attack paths. We discuss the relevant capabilities within Microsoft Defender that help expose or block attack paths.

Microsoft Defender for Identity

For on-premises Active Directory environments connected to Microsoft 365, Defender for Identity is an essential tool. One of the key features is identifying Lateral Movement Paths (LMPs). These are visual paths that show how an attacker could move from a standard account to a sensitive account within your AD domain.

Crucially: Defender for Identity flags the "Riskiest lateral movement paths" as a security assessment. Accounts with 3 or more intermediate hops from non-sensitive to sensitive accounts are considered risky. Recommended actions are then for example: remove that user from the local admin group, or use a separate account for administration on that machine. This closes the path. In other words, Defender for Identity gives you a concrete list of vulnerable routes in your network that you need to close, an enormous help in setting priorities.

Tip: Microsoft Defender for Identity integrates with Secure Score and delivers ~27 recommendations that raise your score. Many of them revolve around reducing lateral movement opportunities, such as "Remove users from highly privileged groups" or "Resolve unsafe protocol settings".

By carrying out these actions you not only improve your score, you also eliminate attack paths.

Microsoft Defender for Endpoint

On the endpoint side (Windows 10/11 clients and servers), Attack Surface Reduction is a powerful defence mechanism. ASR consists of a set of rules that simply block or restrict certain risky actions at system level. This shrinks the attack surface dramatically and often breaks a crucial link in the kill chain of an attack. Some relevant ASR rules regarding lateral movement and privilege escalation:

• Block credential theft from LSASS: this rule prevents unauthorised processes from reading passwords or hashes from the LSASS memory process. This stops tools like Mimikatz that dump credentials (MITRE ATT&CK T1003) and prevents an attacker from harvesting other users' login data on the system, a typical preparation for lateral movement.
• Block process creation via PSExec/WMI: this rule prevents a process from being started remotely via tools like PsExec or via WMI calls. Attackers moving from machine A to B often use such remote execution techniques (MITRE T1021 Remote Services). With ASR active such an attempt dead-ends: the command is simply not executed on the target machine.
• Block code injection and malicious macros: there are also ASR rules that prevent Office applications from starting unexpected child processes or injecting code into other processes. This mainly targets the start of an attack (e.g. a Word macro installing a backdoor). By closing these routes, it becomes harder for an attack to gain a foothold, and indirectly harder to start a lateral trajectory.

Microsoft recommends always turning on at least the standard set of ASR rules, because they have little impact on end users.

That includes the LSASS protection and the WMI/PsExec blocking. In audit logs you can then see whether there is legitimate software that still needs such an action, so you can make targeted exceptions. In general, however, ASR rules deliver a high security gain: many attack techniques that would otherwise be hard to detect are neutralised upfront. That way you cut off potential attack paths before they can be used.

Threat Analytics

Beside preventive measures, insight into threats is also important. For this, Microsoft 365 Defender contains Threat Analytics, a built-in threat intelligence module. In it, Microsoft's security experts publish current reports on emerging threats, threat actor campaigns and new vulnerabilities.

Imagine a Threat Analytics report appears about a new ransomware spreading through a specific leak or misconfiguration. The report shows how the attack proceeds (e.g. "the malware moves laterally via open SMB shares") and gives concrete mitigation tips. Moreover, in your own dashboard you see whether there are already alarm signals or vulnerable systems in your environment related to that threat.

Threat Analytics thus acts as an early warning system. It proactively shows where you may have attack paths that are currently popular with attackers. Your SecOps team can immediately check whether the recommended actions (patching, adjusting configurations) have been carried out. In the context of Zero Trust and continuous improvement this is very valuable: your defence becomes threat-informed. Organisations that actively use threat intelligence often close gaps before they are exploited by a real attack.

In short, Microsoft 365 Defender offers a broad range of capabilities to tackle attack paths: from mapping paths (Defender for Identity LMPs), to preventively blocking typical attack methods (ASR), and staying informed about new tactics (Threat Analytics). Together these tools form a multi-layered defence designed to stop lateral movement early or prevent it entirely.

Attack paths are the hidden stealth routes an attacker uses during a cybersecurity breach.

Conclusion

Attack paths are the hidden stealth routes an attacker uses during a cybersecurity breach. These paths arise from our own infrastructure: users who log in on multiple systems, passwords that linger somewhere, or permissions that are slightly too broad for convenience.

Fortunately, we do not have to watch powerlessly. With the right deployment of Microsoft Defender technology and a Zero Trust mindset we can drastically curb these paths. Key lessons to take away:

• Know your network and identities: use tools like Defender for Identity to expose hidden routes and correct them. Monitor which accounts sign in where and bring in LAPS to stop credential reuse.
• Hardening is key: turn on those Attack Surface Reduction rules; they cause little hindrance but prevent whole classes of attack techniques. Close unnecessary "doors" in the network with firewalls and segmentation. Every boarded-up hatch forces the attacker into riskier, louder methods that you notice more easily.
• Identity & Access Management: implement strict access controls. MFA everywhere, no legacy auth. Do not make your admins permanent gods but give them JIT access preferably.
• Use Secure Score as a guide: Secure Score shows where your biggest gaps sit and whether you are making progress. It is an excellent hook to hang an improvement plan on and to get management on board internally ("our score is now 45%, aiming for 80% within half a year by doing X, Y, Z"). Many Secure Score actions directly influence eliminating attack paths.

With a combination of these measures you create an environment where an attacker has a much harder time moving around. Ideally your network changes from an open office into a vault with separate rooms: even if someone gets in, they stay trapped in one room and cannot reach the crown jewels. You gain time and visibility to respond.

Curious how your organisation is doing on attack paths and general security hygiene? Let us run a Free Email Scan. In it we measure your current Microsoft Secure Score, analyse exposed attack paths and give you a targeted action plan to strengthen your environment. Contact us today, avoid becoming the next target and stay one step ahead of the attacker!