Detecting Domain Controller Authentication Patching (T1556.001)

A domain controller decides who is who for an entire Windows domain. If its authentication process is altered, every account in the domain is affected. MITRE ATT&CK technique T1556.001, Domain Controller Authentication, covers patching that process to bypass normal checks. The tactics are defense impairment, persistence and credential access, and the platform is Windows.

How attackers use it

MITRE describes malware injecting false credentials into the authentication process on a domain controller, creating a backdoor to access any user's account or credentials. Its named example is Skeleton Key (software S0007) from the MITRE catalog, which works by patching the Local Security Authority Subsystem Service (LSASS) on an enterprise domain controller with credentials the adversary can use to bypass normal authentication.

Once patched, an adversary can use the injected password to authenticate as any domain user until the key is erased from memory by a reboot of the domain controller. MITRE notes that this authenticated access may give unfettered access to hosts and resources in environments that rely on single-factor authentication.

Two details are worth taking from this. The change lives in memory, so a reboot clears it, which also means the evidence can disappear. And the damage depends heavily on whether the environment depends on passwords alone.

How to detect it

MITRE lists no data sources on this page. These signals follow from the description:

• Memory based change in LSASS. Process access to lsass.exe on a domain controller by anything other than expected system components. Sysmon event 10 records process access, and your endpoint product may flag LSASS tampering.
• Odd logons. Successful domain logons that do not line up with the expected authentication method, such as accounts authenticating with a type that they normally do not use, or many different accounts all authenticating from one host.
• Reboot gaps. Unplanned domain controller restarts, since a reboot is how the patch clears and an attacker may time one.
• Service and driver loads. New drivers or services on domain controllers that you did not approve. Windows event 7045 records new service installs.
• Account reviews. New or re-enabled accounts that nobody requested.

Domain controllers deserve the strictest logging in your estate, and logs should be forwarded off the machine.

How to reduce the risk

MITRE lists four mitigations.

1. Privileged account management. Audit domain and local accounts and their permission levels regularly, looking for situations where an adversary could gain wide access by getting credentials of a privileged account. The audits should also look at whether default accounts are enabled, and whether new local accounts exist that nobody authorized.
2. Privileged process integrity. Enable protections such as Protected Process Light (PPL) for LSA.
3. Multi-factor authentication. MFA reduces the risk that valid credentials alone grant access, and it matters here because a patched password check does not help an attacker against a second factor that is verified elsewhere.
4. User training. Train users to recognize and handle suspicious email attachments, and use email warning banners for external mail. These address the delivery of malware that could reach a domain controller in the first place.

Check your own environment

# Windows: is LSA protection (RunAsPPL) configured?
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL -ErrorAction SilentlyContinue

# Windows AD: list members of Domain Admins
Get-ADGroupMember "Domain Admins" | Select-Object SamAccountName, objectClass

# Windows: list services and their paths on a domain controller for review
Get-CimInstance Win32_Service | Select-Object Name, PathName, StartMode

Use this as a checklist:

• LSA protection is on for every domain controller.
• Domain Admins membership is small and each member is current.
• Service and driver lists on domain controllers match your build.
• Domain controllers send security logs to a collector.
• Privileged and remote access requires MFA, so a password alone is not enough.

Quick check

Sources

• MITRE ATT&CK T1556.001 Domain Controller Authentication