Suspicious SMB connection from domain controller

Analytics BIOC Low

Suspicious SMB connection from domain controller

A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Use Alternate Authentication Material: Pass the Hash (T1550.002)

Attacker's goals:

An attacker is attempting to steal credentials and move laterally within a network.

Investigative actions:

Check if the destination is domain controller, if it is, exclude it. Look for earlier connections to the DC, which may cause it to initiate the session.

Test period:: N/A (single event)
Deduplication:: 7 Days