<<< Hide Navigation Hide TOC >>>
Active Directory Credential Request (02d090b6-8157-48da-98a2-517f7edd49fc)
Requests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries. Examples:
- Kerberos TGT and Service Tickets (Event IDs 4768, 4769)
- NTLM Authentication Events
- LDAP Bind Requests
Data Collection Measures:
- Security Event Logging:
- Enable "
Audit Kerberos Authentication Service" or "Audit Kerberos Service Ticket Operations." - Captured Events: IDs 4768, 4769, 4624.
- Enable "
- Windows Event Forwarding (WEF): Forward domain controller logs to SIEM.
- SIEM Integration: Use tools like Splunk or Azure Sentinel for log analysis.
- Kerberos Debug Logging:
- Registry Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
- Set DWORD LogLevel to 1.
- Azure AD Logs: Monitor Sign-In Logs for authentication and policy issues.
- Enable EDR Monitoring:
- Use EDR to detect suspicious processes querying authentication mechanisms (e.g., lsass.exe memory access).
