Analytics BIOC
Low
✕
Unusual Azure AD sync module load
A process that does not usually load the Azure AD Sync mcrypt.dll loaded the module.
- Module:
- Identity Threat Detection (ITDR)
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Attacker's goals:
Attackers can abuse the Azure AD Connect database files to get access to the AD Sync account. The AD Sync account is a highly privileged account that can perform a DCSync and get access to on-premise password hashes.
Investigative actions:
See whether this was a legitimate action. Follow process/user/host activities. Follow unusual actions of the AD Sync user. Check for unusual Azure AD authentications. Check for a possible DCSync.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Unusual Azure AD sync module load by suspicious process Medium (parent: Low)