Analytics BIOC Informational
✕

Possible authentication coercion

An unusual Remote Procedure Call (RPC) was made to potentially cause authentication coercion.

Module:
Identity Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Forced Authentication (T1187) Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)
Attacker's goals:

An attacker can abuse Remote Procedure Calls to coerce authentication from servers.

Investigative actions:

Check for a suspicious process on the initiator. Check if the source host is a vulnerability scanner. Check for unusual connections from {actor_remote_ip} to other servers in the network. Check for logged-in users to {actor_remote_ip} and investigate their actions. Check for indicators of compromise on {actor_remote_ip}.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Possible authentication coercion from an unconstrained delegation server to a sensitive server Medium (parent: Informational)
  • Possible authentication coercion to a sensitive server Low (parent: Informational)