Active Directory Reconnaissance
Also calledAD recon, domain reconnaissance, LDAP reconnaissance
Reads the directory in bulk to map accounts, groups, trusts and servers.
- Technique
- MITRE ATT&CK T1087.002: Account Discovery: Domain Account (opens in a new tab)MITRE ATT&CK T1069.002: Permission Groups Discovery: Domain Groups (opens in a new tab)MITRE ATT&CK T1482: Domain Trust Discovery (opens in a new tab)MITRE ATT&CK T1018: Remote System Discovery (opens in a new tab)MITRE ATT&CK T1615: Group Policy Discovery (opens in a new tab)
- Needs
- Domain Account
- Gives
- A map of the domain's accounts, service accounts, groups, trusts and servers, which picks the next target.
How the Attack Works
Every domain account may read most of the directory. An intruder with any foothold can see which accounts have service principal names, which sit in the admin groups, which domains trust which, and where the servers are. The reads use ordinary directory, name-service and SAMR traffic, so they look like administration until their breadth or their source gives them away. A defender treats the volume and the origin as the signal, not any single query.
Read first Authentication and Authorisation, Where Sign-In Evidence Lands
How It Plays Out
The attack step by step. Each step shows which machines take part, what travels, the keys and tickets each side now holds, what is logged and what a defender can see.
ws-042 Foothold
dc-01 Domain controller
Step 1 of 3: Directory Read
ws-042 Foothold to dc-01 Domain controller
A read of the directory
LDAP SearchRequestLDAP, port 389WS-042 asks dc-01 over LDAP for the accounts, groups and trusts in the domain, a read any account may make.
What Defenders See
Where its sensor reads dc-01, Defender for Identity raises its LDAP reconnaissance alerts. By default dc-01 writes no Security event for the read.
Step 2 of 3: Group Query
ws-042 Foothold to dc-01 Domain controller
A query of group membership
SAMR querySAMR over SMB, port 445WS-042 asks dc-01 over SAMR which accounts are in the domain's admin groups.
Logged
5145 A network share object was checked to see whether client can be granted desired access
On dc-01, in the Security log When enabled
A check of the samr named pipe on IPC$ from ws-042.
What Defenders See
With Audit Detailed File Share on, dc-01 writes event 5145 for the samr named-pipe check on IPC$. Defender for Identity raises its SAMR reconnaissance alert.
Step 3 of 3: DNS Map
ws-042 Foothold to dc-01 Domain controller
A request for the DNS zone
DNS queryDNS, port 53WS-042 asks dc-01's DNS for the records that map the network's computers and services.
What Defenders See
Defender for Identity raises its DNS-mapping reconnaissance alert on an excessive or transfer-style request from a machine that is not a DNS server.
Needs First
What the attacker must already hold for this attack to be possible.
- A Domain AccountAny domain account, since any account may read most of the directory.
Comes From
- Domain Account: Password Spraying
Gives the Attacker
What running it hands the attacker to use next.
A map of the domain's accounts, service accounts, groups, trusts and servers, which picks the next target.
What Defenders See
What this attack leaves for a defender to find, and what to read in each. None of it is proof on its own, so treat each as a lead and confirm it against the rest.
| Event and Log | Written On | Look For | Switch It On |
|---|---|---|---|
| 4662 An operation was performed on an object (opens in a new tab) Security log | Domain controllers, for objects with a matching audit entry | A read of a sensitive object's properties on a DC, where an audit entry is set. Reads alone are noisy, so use it to corroborate an alert. | Audit Directory Service Access, and an audit entry (SACL) on the object |
| 5145 A network share object was checked to see whether client can be granted desired access (opens in a new tab) Security log | The server that holds the share, named pipes on IPC$ included | A check of the samr or lsarpc named pipe on IPC$ from a workstation, the SAMR side of a directory sweep. | Audit Detailed File Share |
What It Looks Like
One event from the worked example, decoded field by field, so you can see what to read in it and what each value means.
5145 A network share object was checked to see whether client can be granted desired access
In the Security log on dc-01,
A SAMR named-pipe check on dc-01 from the ws-042 foothold.
The SAM Remote named pipe, the one group-membership queries use. A burst of these from one workstation is the SAMR side of reconnaissance.
As Windows writes it:
Relative Target NamesamrThe hidden inter-process share that carries the named pipe. The pipe, not the share, is what matters here.
As Windows writes it:
Share Name\\*\IPC$ws-042, the foothold. Match it to the account in the same event and to the domain controller the query reached.
As Windows writes it:
Source Address192.0.2.42
Defender for Identity Alerts
Where Defender for Identity runs, its sensors raise these from what they read on the servers they are installed on, domain controllers above all. Each names what it flags, which is a lead to confirm, not proof on its own.
- Account Enumeration reconnaissance (LDAP) (opens in a new tab)
- Security principal reconnaissance (LDAP) (opens in a new tab)LDAP reconnaissance of accounts and groups, often the first phase.
- User and Group membership reconnaissance (SAMR) (opens in a new tab)
- Network-mapping reconnaissance (DNS) (opens in a new tab)
- Suspicious LDAP query (opens in a new tab)
- Suspicious LDAP query targeting sensitive attributes (opens in a new tab)A query aimed at the attributes an attacker wants most.
- Anomalous Samr activity (Preview) (opens in a new tab)
- Possible SPN enumeration via LDAP (opens in a new tab)The search for accounts that have a service name.
- Possible Active Directory enumeration via ADWS (opens in a new tab)The same reads made through Active Directory Web Services.
Blind Spots
Where this attack leaves little or nothing to see, so a quiet log is not read as an all-clear.
- Raw LDAP reads are not written to the Windows Security log, so a quiet query against one domain controller can leave only the identity sensor's record.
- Volume alone misses a slow or narrow query, so alert on reads of sensitive attributes and of decoy accounts, not only on bursts.
Hunt It
The query to run in each tool, and how well each one sees this attack. Pick the tool you use, and the others load their query when you open them.
Needs Defender for Identity sensors on every domain controller. Raw directory reads are not in the Windows Security log, so this table and the recon alerts carry them, and a high count from one device is the lead.
// LDAP and SAMR directory queries the sensor saw, grouped by the device and account that made themIdentityQueryEvents| where Timestamp > ago(How to Prevent It
The controls that break this attack, each with how it helps here and, where the Registry topic has it, where to check it on a machine.
Honeytoken accounts (opens in a new tab)
Seed decoy accounts tagged in Defender for Identity, so a directory query that touches one raises an alert.
Least-privilege administration (opens in a new tab)
Keep the most powerful groups nearly empty, so a map of the admins returns little worth having.
Tiered administration (opens in a new tab)
Keep admin accounts and their workstations apart, so what reconnaissance finds does not point straight at a path in.
Sources
- MITRE ATT&CK T1087.002: Account Discovery: Domain Account (opens in a new tab)
- MITRE ATT&CK T1069.002: Permission Groups Discovery: Domain Groups (opens in a new tab)
- MITRE ATT&CK T1482: Domain Trust Discovery (opens in a new tab)
- MITRE ATT&CK T1615: Group Policy Discovery (opens in a new tab)
- Microsoft Learn: Defender for Identity reconnaissance and discovery alerts (opens in a new tab)
- Microsoft Learn: Defender for Identity discovery alerts (XDR) (opens in a new tab)
- Microsoft Learn: IdentityQueryEvents table, advanced hunting (opens in a new tab)
- Microsoft Learn: 4662, an operation was performed on an object (opens in a new tab)
- Microsoft Learn: 5145, a network share object was checked to see whether client can be granted desired access (opens in a new tab)