Hi,
I am currently working on a search that is supposed to tell me whether users went the prescribed CyberARK route or bypassed it for system access.
So theoretically I should use for events 4624 and 4648 and see whether the connctions come from CyberARK or not.
But I found plenty of login events from the Citrix servers where our users do their work.
Following up on this it turns out, that users on Citrix use a web browser to access an application on the target system that uses SSO for the user login.
This also shows up as 4624. Which for my purpose would be a false positive.
Looking closer that the generated 4624 events, the key difference is the LogonProcessName and
AuthenticationPackageName in the event.
If AuthenticationPackageName=NTLM or LogonProcessName=NtLmSsp, then this seems to indicate a SSO login.
And AuthenticationPackageName=Kerberos or LogonProcessName=Kerberos seem to be indicators of an RDP session (via CyberARK).
Excluding the NtLm events seems to be the way to go, but as my Windows background is pracitcally NIL after years of AIX/Linux I wonder wheter someone could confirm my hypothesis.
Unfortunately I do not have a lab for checking this with a control case.
thx
afx
