Analytics Alerts

Cached credentials discovery with cmdkey Low 2 variations

Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)

ATT&CK techniques: OS Credential Dumping (T1003) Account Discovery (T1087)

Required data: XDR Agent

Attacker's goals: Access cached user credentials.

Investigative actions: Check the initiator process for additional suspicious activity. Check if the host is a shared host that multiple users' credentials can be extracted from.

Variations

The process cmdkey runs with modified name and extract cached credentials

High overridden

Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list. overridden

Transfer cached credentials with cmdkey to other standard output

Medium overridden

Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list. overridden

Discovery of accounts with pre-authentication disabled via LDAP Low Identity Analytics 1 variation

A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: Account Discovery (T1087) Steal or Forge Kerberos Tickets: AS-REP Roasting (T1558.004)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: LDAP Analytics (Server), LDAP Analytics (Client)

Attacker's goals: An attacker is attempting to enumerate Active Directory.

Investigative actions: Check if the process executes LDAP search queries as part of its normal behavior. Investigate the LDAP search query for any suspicious indicators. Correlate logs from the same host or user for related LDAP queries or other unusual activities. Audit accounts flagged as not requiring pre-authentication and verify compliance with security policies. Determine whether the search query is generic. Wide search queries (often using wildcards) tend to be more suspicious. In our case, we are looking for targeted search queries.

Variations

Suspicious discovery of accounts without pre-authentication required via LDAP

Medium overridden

A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization. overridden

Interactive local account enumeration Low Identity Analytics

Multiple non-existing accounts attempted interactive local logins to a host within a short period.This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: Account Discovery (T1087) Brute Force (T1110)

Required data: XDR Agent

Attacker's goals: Discover valid accounts to gain credentials.

Investigative actions: Check if the login attempts were part of a legitimate misunderstanding of the system or part of an attack.

LDAP AD CS Enumeration via Attack Tool Low Identity Analytics 1 variation

A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: Account Discovery (T1087) Steal or Forge Authentication Certificates (T1649)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: LDAP Analytics (Client), LDAP Analytics (Server), Active Directory Certificate Services Analytics

Attacker's goals: An attacker is attempting to enumerate Active Directory.

Investigative actions: Check if the process executes LDAP search queries as part of its normal behavior. Investigate the LDAP search query for any suspicious indicators. Determine whether the search query is generic. Wide search queries (often using wildcards) tend to be more suspicious. In our case, we are looking for targeted search queries.

Variations

Abnormal LDAP AD CS Enumeration via Attack Tool

Medium overridden

A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization. overridden

Remote account enumeration Informational Identity Analytics 2 variations

Multiple non-existing accounts failed to remotely log in to a host in a short period of time.This may indicate an attacker is trying to remotely enumerate accounts.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: Account Discovery (T1087) Brute Force (T1110)

Required data: XDR Agent

Attacker's goals: Discover valid accounts to gain credentials.

Investigative actions: Check if the login attempts were part of a legitimate misunderstanding of the system or part of an attack.

Variations

Suspicious Remote domain account enumeration

Medium overridden

Multiple non-existing accounts failed to remotely log in to a host in a short period of time.This may indicate an attacker is trying to remotely enumerate accounts. overridden

Remote account enumeration on domain accounts

Low overridden

Multiple non-existing accounts failed to remotely log in to a host in a short period of time.This may indicate an attacker is trying to remotely enumerate accounts. overridden

Uncommon access to /etc/passwd Informational 11 variations

A process made an uncommon attempt to access /etc/passwd.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: File and Directory Discovery (T1083) System Service Discovery (T1007) System Owner/User Discovery (T1033) System Information Discovery (T1082) Account Discovery (T1087) Account Discovery: Local Account (T1087.001) OS Credential Dumping (T1003)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: EDR Discovery Analytics, Credentials Grabbing Analytics

Attacker's goals: Attackers may attempt to access sensitive files to steal credentials, perform reconnaissance on system configurations and users, and find pathways for lateral movement.

Investigative actions: Review the event's context - examine the process, its command line, and its origin to gain a comprehensive understanding of the anomalous access. Assess the behavior's legitimacy: Given that this is an uncommon event, determine if this file access is an expected and authorized behavior for the actor process.

Variations

Uncommon access to /etc/passwd by a security testing tool

Medium overridden