Analytics BIOC
High
✕
Possible Distributed File System Namespace Management (DFSNM) abuse
A possible abuse of Distributed File System Namespace Management (DFSNM).
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Forced Authentication (T1187) Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)
Attacker's goals:
An attacker can abuse the Distributed File System Namespace Management protocol to coerce an authentication from a DC. This authentication can later be used for obtaining a DC certificate for DCSync.
Investigative actions:
Check for a suspicious process on the initiator. Check if the source host is a vulnerability scanner. Look for unusual AD CS certificate requests. Check for possible DCSync alerts.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day