USER ID Lateral Movement reported

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

USER ID Lateral Movement reported

L0 Member

We have USER-ID Agent installed on 2 Domain Controllers, using a Service account to authenticate to the Domain referencing the Workstations (Laptops)

We use Rapid7 InsightIDR for our SEIM solution and USER-ID on a DC to authenticate/identify Workstation details.

 

The SEIM is flagging USER-ID traffic from a Workstation to another Workstation as 'authenticated to asset from unfamiliar source'

 

Can anyone advise;

 

If this is expected behavior or something that should not be happening. i.e. 

    OR just between DC and Workstation
How can I stop this from happening or is this by design?

Many thanks

1 REPLY 1

Cyber Elite
Cyber Elite

@DinoAdami,

Out of curiosity, how are you identifying this as actual User-ID traffic? I'm assuming what you're seeing is WMI traffic and associating this with user-id? 

  • 1050 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!