Navigation :

Authentication Against a New Domain Controller

Description

A common indicator for lateral movement is when a user starts logging into new domain controllers.

Use Case

Advanced Threat Detection

Security Impact

Once an attacker gains access to a network either through a compromised asset or credentials, most will attempt to then move laterally within the network targeting critical infrastructure. As domain controllers provide the physical storage for the Active Directory Domain Services (AD DS) database, in addition to providing the services and data that allow enterprises to effectively manage endpoints (servers and workstations), users, and applications. If privileged access to a domain controller is obtained by a malicious user, that adversary can modify, corrupt, or destroy the AD DS database and, along with all of the systems and accounts that are managed by Active Directory. By monitoring both successful and unsuccessful authentication attempts organizations can identify anomalies such as time of day, frequency and other suspicious patters that may indicate compromised assets or credentials.

Alert Volume

Medium (?)

SPL Difficulty

Medium

Journey

Stage 1

MITRE ATT&CK Tactics

Lateral Movement

MITRE ATT&CK Techniques

Remote Services

MITRE Threat Groups

APT39

GCMAN

Leviathan

OilRig

TEMP.Veles

menuPass

Kill Chain Phases

Installation

Data Sources

Windows Security

How to Implement
Implementation of this example (or any of the First Time Seen examples) is generally very simple. Validate that you have the right data onboarded, and that the fields you want to monitor are properly extracted. Save the search. For most environments, these searches can be run once a day, often overnight, without worrying too much about a slow search. If you wish to run this search more frequently, or if this search is too slow for your environment, we recommend leveraging a lookup cache. For more on this, see the lookup cache dropdown below and select the sample item. A window will pop up telling you more about this feature.

How to Implement

Implementation of this example (or any of the First Time Seen examples) is generally very simple.

Validate that you have the right data onboarded, and that the fields you want to monitor are properly extracted.
Save the search.

For most environments, these searches can be run once a day, often overnight, without worrying too much about a slow search. If you wish to run this search more frequently, or if this search is too slow for your environment, we recommend leveraging a lookup cache. For more on this, see the lookup cache dropdown below and select the sample item. A window will pop up telling you more about this feature.

Known False Positives
This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over (or for the lookup cache feature, the first occurrence over whatever time period you built the lookup). But while there are really no "false positives" in a traditional sense, there is definitely lots of noise. You should not review these alerts directly (except for high sensitivity accounts), but instead use them for context, or to aggregate risk (as mentioned under How To Respond).

Known False Positives

This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over (or for the lookup cache feature, the first occurrence over whatever time period you built the lookup). But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.

You should not review these alerts directly (except for high sensitivity accounts), but instead use them for context, or to aggregate risk (as mentioned under How To Respond).

How To Respond
When this search returns values, initiate your incident response process and identify the user account accessing the specific domain controller. Contact the user and system owner about this action. If it is authorized, document that this is authorized and by whom. If not, the user credentials may have been used by another party and additional investigation is warranted to determine that lateral movement is not occurring.

How To Respond

When this search returns values, initiate your incident response process and identify the user account accessing the specific domain controller. Contact the user and system owner about this action. If it is authorized, document that this is authorized and by whom. If not, the user credentials may have been used by another party and additional investigation is warranted to determine that lateral movement is not occurring.

Help
Authentication Against a New Domain Controller Help This example leverages the Detect New Values search assistant. Our dataset is a anonymized collection of Windows domain controller logon events (Event ID 4776). For this analysis, we are effectively grouping by username and domain controller name, which will give us a row for each username+domaincontrollername combination. We check if the first time that has occurred was in the last day.

Help