Unusual ADConnect database file access

Analytics BIOC Informational

Unusual ADConnect database file access

An unusual process accessed the ADConnect database files.

Module:: Platform Analytics
Data source:: XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Unsecured Credentials (T1552)

Attacker's goals:

Attackers can abuse the Azure AD Connect database files to get access to the AD Sync account. The AD Sync account is a highly privileged account that can perform a DCSync and get access to on-premise password hashes.

Investigative actions:

See whether this was a legitimate action. Follow process/user/host activities. Follow unusual actions of the AD Sync user. Check for unusual Azure AD authentications. Check for a possible DCSync.

Test period:: N/A (single event)
Deduplication:: 1 Day

2 variations:

Suspicious access to ADConnect database file Medium (parent: Informational)
Access to ADConnect database file by an unsigned or unusual process Low (parent: Informational)