topic Credential Phishing with credential submission method as Use Domain Credential Filter in General Topics

Credential Phishing with credential submission method as Use Domain Credential Filter

bgunasekar — Wed, 24 May 2017 22:47:31 GMT

Hello team,

Customer has configured Credential Phishing with credential submission method as Use Domain Credential Filter and it does not work
The user id agent is configured on the writeable domain controller
But according to the below document to enable credential detection, must install the Windows-based User-ID agent on an RODC
https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/configure-credential-detection-with-the-windows-based-user-id-agent#_20973

Wanted to verify if RODC is mandatory to enable credential detection or will it work on writeable domain controller

The output of show user user-id-agent state SVR-DC2 is attached

Kindly verify regarding the same

Regards

Banu Priya

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

Brandon_Wertz — Thu, 25 May 2017 17:45:20 GMT

When you asked the question, I was thinking the RODC was just a suggestion for security reasons, and the link you tagged actually states as such:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/configure-credential-detection-with-the-windows-based-user-id-agent#_20973

"Installing the User-ID agent on an RODC can be useful for a few reasons: access to the domain controller directory is not required to enable credential detection and you can support credential detection for a limited or targeted set of users. Because the directory the RODC hosts is read-only, the directory contents remain secure on the domain controller."

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

staustin — Sun, 22 Apr 2018 22:27:19 GMT

Did you get your issue resolved?

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

cenders — Mon, 18 Jun 2018 22:36:11 GMT

I'd like to know the same, for I'd like to implement but I don't want to set up an RODC for the sole purpose of supporting this.

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

OmPrasad — Tue, 07 Jan 2020 13:05:54 GMT

Have you got answer for this ?

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

Remo — Wed, 15 Jan 2020 20:45:36 GMT

Unfortunately for this feature to work an RODC is required. Starting from windows server 2012 (or maybe even 2008) the password hashes are not readable from an AD joined server and not even on the domaincontroller itself - even obviously the password hashes are available there. The only way to read these hashes is on an RODC.

(I received this answer from PaloAlto Support)

Re: Credential Phishing with credential submission method as Use Domain Credential Filter

OmPrasad — Thu, 16 Jan 2020 06:41:47 GMT

Yes, I tested the same configuring RODC when it was not working on AD. It worked on RODC only.

Re: Credential Phishing with credential submission method as Use Domain Cre

Sec101 — Tue, 09 Jun 2020 18:55:07 GMT

this is exactly what we needed to know.