Forum Discussion

Peter Holland's avatar
Peter Holland
Iron Contributor
Jan 26, 2017

1.7.575.57477 lots of "Reconnaissance using directory service enumeration"

Hi,

 

 

I am seeing a lot of "Suspicious Activity" in ATA relating to "Reconnaissance using directory services enumeration" from clients and servers.

I believe this was addressed in an earlier build of 1.7, am i safe to assume that these incidences are worthy of investigation?

 

Kind Regards

 

Pete Holland

  • Hi,

    As you mentioned this is a known issue with ATA 1.7.
    In some cases this suspicious activity can be caused by legitimate security solutions running on endpoints and servers. With ATA 1.7 Update 1 we've introduced the ability to disable this detection in order to stop generating these alerts. However it requires an additional manual step after deploying ATA 1.7 Update 1, which is decsribed at https://support.microsoft.com/en-us/help/3191777/description-of-update-1-for-microsoft-advanced-threat-analytics-v1.7

     

    We're further adding clustering and other elemets to the detection logic in the upcoming release of ATA to improve the detection itself and automatically address this scenario.

     

    Hope this helps!

    Michael.

  • Hi,

    As you mentioned this is a known issue with ATA 1.7.
    In some cases this suspicious activity can be caused by legitimate security solutions running on endpoints and servers. With ATA 1.7 Update 1 we've introduced the ability to disable this detection in order to stop generating these alerts. However it requires an additional manual step after deploying ATA 1.7 Update 1, which is decsribed at https://support.microsoft.com/en-us/help/3191777/description-of-update-1-for-microsoft-advanced-threat-analytics-v1.7

     

    We're further adding clustering and other elemets to the detection logic in the upcoming release of ATA to improve the detection itself and automatically address this scenario.

     

    Hope this helps!

    Michael.

    • Peter Holland's avatar
      Peter Holland
      Iron Contributor

      Hi Michael,

       

      Many thanks, i had overlooked the actual activity required to disable this detection.

       

      From a technical standpoint I am surprised that machines enumerate all AD objects quiet so often, or at all, i wouldnt have thought they would have a need to know of anything else in Active Directory until they need to interact with the object.

       

      Kind regards

       

      Pete

      • Michael Dubinsky's avatar
        Michael Dubinsky
        Icon for Microsoft rankMicrosoft

        So were we. I do suggest you look into the solution generating those queries (more from an operational perspective). 

    • Αντρέας Νικολάου's avatar
      Αντρέας Νικολάου
      Copper Contributor

      Hello,

      We have been receiving alerts for directory service enumeration and I was wondering if those were triggered from legitimate security solutions. When you refer to legitimate security solutions are you talking about tools for administration? Is there a reason for any other program to do directory service enumeration to pull all domain users? 

      Andreas

      • Michael Dubinsky's avatar
        Michael Dubinsky
        Icon for Microsoft rankMicrosoft

        Hi,

        I'm familiar with a scenario where security scanners trigger these alerts but not admin tools. 

        However - there could be a 3rd party tool which (for some reason) decided to use this specific RPC call. 

         

        HTH.

        BTW - In v.next we're adding a learning mechanism to avoid these exact scenarios.

Resources