Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	XDR Agent
Detection Modules	Identity Analytics
Detector Tags	Microsoft SCCM Analytics
ATT&CK Tactic	Credential Access (TA0006), Lateral Movement (TA0008)
ATT&CK Technique	Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay (T1557.001), Use Alternate Authentication Material: Pass the Hash (T1550.002)
Severity	Informational

Description

Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs in a short period of time. This might indicate a potential NTLM Relay attack.

Attacker's Goals

An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.

Investigative actions

• Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
• Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
• Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
• Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
• Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.

Variations

Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server using a vulnerable package

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Lateral Movement (TA0008)
ATT&CK Technique	Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay (T1557.001), Use Alternate Authentication Material: Pass the Hash (T1550.002)
Severity	Low

Description

Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs using a vulnerable NTLM package in a short period of time. This might indicate a potential NTLM Relay attack.

Attacker's Goals

An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.

Investigative actions

• Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
• Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
• Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
• Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
• Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.