Credential-Based Attacks: Detection Engineering Deep Dive
Atlas home · Research path · Operational families · Anomaly models · Visual index
Consolidated 27 September 2026 from the revised publication. Source-reported incidents, proposed models, functional tests, and synthetic results remain separate evidence classes. Provenance and review scope.
Kerberoasting
Kerberoasting obtains service-ticket material for offline password recovery. The service key depends on the encryption type: RC4-HMAC and AES must not be explained as the same NTLM-hash encryption mechanism. Ordinary users requesting service tickets is normal authentication behavior. MITRE T1558.003.
Event 4769 can support investigation when the relevant DC auditing is enabled. Preserve requester identity, source address, target service, encryption type, result and event version. A rule limited to RC4 (0x17) cannot claim AES (0x11/0x12) coverage. Broader request breadth and novelty can be considered across encryption types; a low-volume targeted request may evade either approach.
Do not exclude every machine account or service merely because its name ends in $. Such filtering is an explicit scope reduction with blind spots, not a proof of legitimacy. Section 8 excludes krbtgt from its service-breadth example, keeps computer principals visible, and reports encryption types rather than treating RC4 as a verdict. The distinct-service count is only as meaningful as the service identifier emitted by the source.
Text equivalent and full-size diagram
Breadth and novelty need a workload baseline. Low-volume targeting can evade breadth rules, and a name ending in $ is not a blanket safe exclusion.
The arrows describe an analyst workflow: observe 4769 on a domain controller; compare request breadth and novelty against role and workload; corroborate source-process activity, authorization and purpose. They are not a mandatory attack sequence.
Preserve requester, source address, target service, result, event version and ticket encryption type. Verify the service identifier actually emitted: native ServiceName describes an account or computer, not necessarily a unique SPN.
For TicketEncryptionType, RC4-HMAC is 0x17; AES128-CTS-HMAC-SHA1-96 is 0x11; AES256-CTS-HMAC-SHA1-96 is 0x12. RC4 and AES do not share the same NTLM-hash key derivation. Do not use these enum values as a supported-types bitmask.
Enable and validate relevant DC auditing. Routine requests are legitimate, sparse targeting may not exceed breadth thresholds, and no universal count threshold is given. The zero-match public replay remains visible in the existing results, not retested by importing artwork.
DCSync
Replication abuse uses directory replication permissions to retrieve credential material. A tool name alone does not establish this mode. For event 4662, configure Directory Service Access auditing and an applicable SACL on the domain object. The SACL controls auditing; the DACL and effective directory permissions determine access. Microsoft 4662 reference.
Relevant extended-right GUIDs include Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) and Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c). Interpret these with the control-access bit (0x100), object type and complete session evidence. They need not all appear in one event, and one matching right does not prove successful credential extraction.
Event 4662 has no native client-IP field. Correlate to a suitable logon record using the same DC, normalized logon identifier and bounded event time. Preserve unresolved or ambiguous correlations rather than dropping the candidate or inventing an address. Validate parser aliases and logon-ID reuse.
Approved replication should be an inventory-backed, time-bounded principal/source relationship. Entra Connect, backup and identity systems need verified exceptions—not blanket MSOL_*, AADConnect* or computer-account exclusions. Compromise of an approved source remains a blind spot. The provided rule reports candidates; it does not silently discard approved-looking accounts.
Text equivalent and full-size diagram
A SACL selects auditing; effective permissions govern access. Verify approved principal–source relationships without treating an approved source as uncompromisable.
Directory-access record 4662 contributes principal, SubjectLogonId, object, rights and AccessMask. A suitable 4624 record contributes TargetLogonId and source address only when available. These are separate source records.
Join on the same DC and normalized logon ID, check identity consistency, preceding bounded event time and identifier reuse. Preserve correlated, unresolved and ambiguous outcomes instead of manufacturing a source address.
Evaluate extended rights with the control-access bit 0x100: Get-Changes = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2; Get-Changes-All = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2; Get-Changes-In-Filtered-Set = 89e95b76-444d-4c62-991a-0facbeda640c. All three need not appear in one event.
Configure Directory Service Access auditing and an applicable SACL on the domain object. A SACL is not a permission grant. Audit records are not direct proof of secret extraction. Validate exceptions against current principal/source inventory, scope and time; avoid blanket account-name exclusions.
Pass-the-Hash
Pass-the-Hash uses captured credential material to perform authentication without the cleartext password. It does not transmit the NTLM hash directly as a password; distinguish the hash from the challenge-response exchange. MITRE T1550.002.
Target-side NTLM network logons (4624, type 3) are common and do not by themselves identify PtH. A null subject SID or zero key length is not proof that there was no earlier interactive session on the source. Source-side type 9 (NewCredentials) with seclogo is a useful additional hunting view for some implementations, but can also occur with legitimate alternate-credential workflows. Other PtH implementations need not produce that pattern. Microsoft 4624 fields.
Correlate identity, source process, destination, authentication and authorized administration. Absence of a prior event is meaningful only with adequate collection, retention and clock alignment. Section 8 intentionally returns two different evidence classes, not a binary PtH classification.
Text equivalent and full-size diagram
NTLM uses challenge–response; the stored hash is not transmitted as a password. Validate authorization and collection before assigning intent or interpreting missing events.
The source-side card shows 4624 type 9, NewCredentials, with LogonProcess seclogo. This pattern can appear with some implementations and with legitimate alternate-credential workflows. It is not required for every PtH implementation.
The target-side card shows 4624 type 3, Network, with AuthenticationPackage NTLM. Ordinary network authentication can produce the same view. The two cards are evidence classes, not a complete implementation inventory.
Correlate outbound identity, source process, destination and authorized administration within bounded time. Type 9 can retain the local identity while specifying different outbound credentials. A local logon identifier is not a global identity or cross-host join key.
Null Subject SID, zero key length or a missing earlier logon does not establish PtH. Verify collection, retention and clock alignment. The NTLM exchange uses a response computed from credential material rather than sending the stored hash as a password.
LSASS Credential Dumping (Sysmon Event 10)
LSASS process access can support credential-access investigations, but legitimate security and diagnostic software also accesses it. GrantedAccess is a bitmask: 0x1010 combines VM read and limited query information; 0x1410 additionally includes query information. These masks do not certify malicious intent. Microsoft process-access rights.
Use the source/target process identifiers, actual access rights, signer/hash, ancestry, call trace and available memory evidence. An unresolved call trace is not proof of injection. A familiar filename, signature or trusted directory is not a safe universal exclusion. Exceptions require provenance, scope, owner, expiry and periodic review; they can otherwise conceal abuse of a trusted process.
Text equivalent and full-size diagram
These masks are examples, not exhaustive coverage. An unresolved call trace or familiar signer is not a verdict; validate provenance, collection and scoped exceptions.
A source process opens lsass.exe with GrantedAccess. Preserve the source and target process GUIDs and images, access rights and call trace. The arrow depicts an access relationship, not confirmed memory dumping.
PROCESS_VM_READ = 0x0010; PROCESS_QUERY_INFORMATION = 0x0400; PROCESS_QUERY_LIMITED_INFORMATION = 0x1000. Bitwise OR gives 0x1010 from limited query plus VM read, and 0x1410 when query information is also set.
Read-capable access is not proof of memory reads or recovered credentials. Other access paths and masks exist. Validate Sysmon filtering and sensor health; join process-creation context, signer/hash, ancestry and available memory evidence rather than assuming every enrichment field is native to Event 10.
Security and diagnostic tools can access LSASS legitimately. Missing call-trace resolution does not establish injection. A familiar filename, signature or directory is not a universal safe exclusion; review exceptions with an owner, scope and expiry.
[
{
"mask": "0x1010",
"components": [
"0x1000",
"0x0010"
],
"decimal": 4112,
"meaning": "Access rights only; not observed memory reads or credential extraction."
},
{
"mask": "0x1410",
"components": [
"0x1000",
"0x0400",
"0x0010"
],
"decimal": 5136,
"meaning": "Access rights only; not observed memory reads or credential extraction."
}
]Technique workspaces
Follow the exact technique ID to source rules, associated tools, collection references, and documented lab candidates. A navigation association is not live validation.