This question may not 100% related with Splunk but I am sure Splunker had done this many times so I thought I will just ask
I want to identify the real destination when user logon a host using authenticate through DC like Kerobers or NTLM. I looked at event 4624, 4768,4771 on the DC log, they only have real src information, but I cant find the real dest information in these event. Is there another event I should look at or it is some field is missing on these events? my example as below
user A using host A to logon to host C by go through DC B. and I only collect log at DC B, so I want to know how to identify the host C information from the log in this scenario.
This might be possible with NTLM authentication, but Kerberos doesn't work that way.
With Kerberos, user A interacts with DC B from host A, then proceeds directly to host C with its service ticket in hand for the service(s) running on host C.
Under NTLM, host C will challenge user A to authenticate, which host C might verify with DC B (it very well could be some other domain controller). I think only with NTLM will you possibly see host C authenticating user A on DC B, but only if host C uses DC B...