DSA credential disclosure via coerced NTLM authentication

Improper authentication in Microsoft Defender for Identity allows remote attackers to capture a DSA account's Net-NTLM hash. The classic sensor's lateral-movement-path collector reacts to a crafted domain-controller event by querying the attacker's host over SAM-R, permitting Kerberos to fall back to NTLM and sending DSA authentication material. Exploitation requires local-network access, a DNS record for the attacker host, and an anonymous connection that generates the trigger event; cracking or relaying the captured hash can compromise the DSA account only when additional conditions permit it.