topic Re: Cortex XDR Remote account enumeration in Advanced Threat Prevention Discussions

Cortex XDR Remote account enumeration

LukasB — Thu, 15 Sep 2022 18:21:41 GMT

Hello,

today we have interesting alert

At least 33 distinct non-existing accounts failed to remotely log in to XX-Laptop1. Users list: name.user, user name, user.name, username

User has no idea - all day at school, behind NAT. What I cannot really understand how terminal service can be used when is user behind NAT and there is no port forwarding and any kind of redirect.

Any idea what to check next?

src. IP adresses looks ok via Virus Total

95.143.188.128
95.143.188.126
95.143.188.122
95.143.188.129

Re: Cortex XDR Remote account enumeration

LukasB — Thu, 15 Sep 2022 19:35:31 GMT

Ok, so the user was not behind NAT, but school Campus with /20 subnet.
Can anyone explain me, why cortex says the SRC_HOSTNAME = MSTSC.EXE? Does it makes sence?

Probably the FW is not switch to the public, so we will have to investigate the GPO.

Re: Cortex XDR Remote account enumeration

LukasB — Wed, 02 Nov 2022 17:22:35 GMT

We found out that GPO for local firewall was disabled, so once the laptop left domain, it did not switch to the public profile...

Re: Cortex XDR Remote account enumeration

Rashele-Shoun — Mon, 18 Sep 2023 15:33:36 GMT

Thanks for posting this! This reaffirmed my analysis of a very similar issue!