Splunk Enterprise Security

How to identify which host the user is trying to access by using windows DC log.


This question may not 100% related with Splunk but I am sure Splunker had done this many times so I thought I will just ask

I want to identify the real destination when user logon a host using authenticate through DC like Kerobers or NTLM. I looked at event 4624, 4768,4771 on the DC log, they only have real src information, but I cant find the real dest information in these event. Is there another event I should look at or it is some field is missing on these events? my example as below

user A using host A to logon to host C by go through DC B. and I only collect log at DC B, so I want to know how to identify the host C information from the log in this scenario.

Thank you in advanced.


This might be possible with NTLM authentication, but Kerberos doesn't work that way.

With Kerberos, user A interacts with DC B from host A, then proceeds directly to host C with its service ticket in hand for the service(s) running on host C.

Under NTLM, host C will challenge user A to authenticate, which host C might verify with DC B (it very well could be some other domain controller). I think only with NTLM will you possibly see host C authenticating user A on DC B, but only if host C uses DC B...

Check this page for a decent graphic on how NTLM works:

And this page for how Kerberos works:

I think the only way to make sure you capture this would be to turn on security auditing/logging on host C.

Hope that helps!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!