How to identify which host the user is trying to access by using windows DC log.

[samlinsongguo]

This question may not 100% related with Splunk but I am sure Splunker had done this many times so I thought I will just ask

I want to identify the real destination when user logon a host using authenticate through DC like Kerobers or NTLM. I looked at event 4624, 4768,4771 on the DC log, they only have real src information, but I cant find the real dest information in these event. Is there another event I should look at or it is some field is missing on these events? my example as below

user A using host A to logon to host C by go through DC B. and I only collect log at DC B, so I want to know how to identify the host C information from the log in this scenario.

Thank you in advanced.

[rmmiller]

This might be possible with NTLM authentication, but Kerberos doesn't work that way.

With Kerberos, user A interacts with DC B from host A, then proceeds directly to host C with its service ticket in hand for the service(s) running on host C.

Under NTLM, host C will challenge user A to authenticate, which host C might verify with DC B (it very well could be some other domain controller). I think only with NTLM will you possibly see host C authenticating user A on DC B, but only if host C uses DC B...

Check this page for a decent graphic on how NTLM works:
https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de1767...

And this page for how Kerberos works:
https://www.manageengine.com/products/active-directory-audit/kb/windows-security-log-event-id-4768.h...

I think the only way to make sure you capture this would be to turn on security auditing/logging on host C.

Hope that helps!
rmmiller