Active Directory Credential Request

Requests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries. Examples:

• Kerberos TGT and Service Tickets (Event IDs 4768, 4769)
• NTLM Authentication Events
• LDAP Bind Requests

Data Collection Measures:

• Security Event Logging:
  • Enable "Audit Kerberos Authentication Service" or "Audit Kerberos Service Ticket Operations."
  • Captured Events: IDs 4768, 4769, 4624.
• Windows Event Forwarding (WEF): Forward domain controller logs to SIEM.
• SIEM Integration: Use tools like Splunk or Azure Sentinel for log analysis.
• Kerberos Debug Logging:
  • Registry Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
  • Set DWORD LogLevel to 1.
• Azure AD Logs: Monitor Sign-In Logs for authentication and policy issues.
• Enable EDR Monitoring:
  • Use EDR to detect suspicious processes querying authentication mechanisms (e.g., lsass.exe memory access).