USER ID Lateral Movement reported

DinoAdami — Thu, 06 Oct 2022 13:30:54 GMT

We have USER-ID Agent installed on 2 Domain Controllers, using a Service account to authenticate to the Domain referencing the Workstations (Laptops)

We use Rapid7 InsightIDR for our SEIM solution and USER-ID on a DC to authenticate/identify Workstation details.

The SEIM is flagging USER-ID traffic from a Workstation to another Workstation as 'authenticated to asset from unfamiliar source'

Can anyone advise;

If this is expected behavior or something that should not be happening. i.e.

OR just between DC and Workstation
How can I stop this from happening or is this by design?

Many thanks

Re: USER ID Lateral Movement reported

BPry — Mon, 10 Oct 2022 02:59:47 GMT

@DinoAdami,

Out of curiosity, how are you identifying this as actual User-ID traffic? I'm assuming what you're seeing is WMI traffic and associating this with user-id?

topic USER ID Lateral Movement reported in General Topics

USER ID Lateral Movement reported

Re: USER ID Lateral Movement reported