StealthINTERCEPT®

Short Summary

Attacks on organizational IT systems increasingly target identity infrastructure, especially Microsoft Active Directory (AD), to obtain credentials, escalate privileges, and enable ransomware, data theft, and regulated-data loss penalties. Traditional perimeter controls (firewalls, IDS/IPS) remain necessary but often cannot detect credential misuse, insider threats, access abuse, data exfiltration, or zero-day activity. SIEM can help, but only if it incorporates access-related data; in practice it has often failed to deliver actionable intelligence fast enough to prevent damage. Modern attacks are typically multi-step and may include an insider element, exploiting known Windows/AD weaknesses to reach Domain Controllers and mint seemingly legitimate credentials.

Key examples include Kerberos elevation-of-privilege attacks (e.g., MS14-068, with tooling like PyKEK), and credential harvesting or manipulation via LSASS, where some newer Windows protections (Virtual Secure Mode/Credential Guard) exist but are not universally deployed. Password rotation and complexity rules are common, yet many organizations do not follow NIST SP800-63B guidance to screen new passwords against those found in breach corpuses, leaving them exposed to credential reuse and password guessing.

The text positions strong AD defense as a top cyber-defense priority: assume AD is under attack or already breached; remove known vulnerabilities; patch; continuously monitor configuration and activity (including directory synchronization); and automatically block suspicious behavior.

It then describes STEALTHbits Technologies and StealthINTERCEPT v5.1, a real-time change/access monitoring and policy enforcement product for AD, file systems, and Exchange. StealthINTERCEPT intercepts event data at the source (reducing dependence on native logs), applies preconfigured attack analytics, integrates with SIEM tools, supports investigation workflows (“Who? What? Where? When?”), and can enforce controls such as enterprise password quality checks, LSASS protection, DCSync detection/prevention, Kerberos weak-encryption detection, and detection of forged Kerberos PACs. Strengths include predefined best-practice templates and automated enforcement of Microsoft recommendations (ESAE/domain isolation), while maximum value is achieved when deployed alongside other STEALTHbits products as part of a complete cyber-defense approach.

Interesting Facts

• Cyber criminals regularly exploit vulnerabilities and poor practices around Microsoft Active Directory to obtain credentials for infiltration and data exfiltration.
• Traditional firewalls, IDS, and IPS cannot detect threats such as compromised credential use, insider threats, access misuse, data exfiltration, and zero-day attacks.
• SIEM effectiveness depends on incorporating access-related data, yet it has often not delivered actionable intelligence in time to avert damage.
• Known Windows and Active Directory vulnerabilities can be used to gain administrative access to Active Directory Domain Controllers if not properly defended.
• The Kerberos vulnerability MS14-068 is referenced, and the Python Kerberos Exploitation Kit (PyKEK) is stated as readily available.
• Attacks against Windows LSASS can be used to obtain and use credentials held in memory.
• Virtual Secure Mode with Credential Guard can protect against certain LSASS-related attacks in Windows 10 Enterprise and Windows Server 2016, but not all organizations use these.
• NIST SP800-63B recommends screening new passwords to prevent using ones obtained from previous breach corpuses.
• StealthINTERCEPT v5.1 includes additions to native AD monitoring, password quality enforcement, and new default templates.
• StealthINTERCEPT provides certified SIEM integration options including IBM QRadar, Splunk, RSA Security Analytics, and ArcSight from Micro Focus.

Notable Quotes

• “You must always assume that your AD is under attack and may already have been breached.”
• “Take active steps to remove known vulnerabilities, apply relevant patches and fully monitor configuration as well as activity.”
• “Monitor not only normal administrative actions but also operations like directory synchronization and automatically block suspicious activity as soon as it is detected.”
• “While these remain an essential part of the defence for the connected business, they are not able to detect a range of threats including the use of compromised credentials, insider threats, data exfiltration, access misuse and zero-day attacks.”
• “To be effective SIEM needs to incorporate access related data.”
• “StealthINTERCEPT detects changes by intercepting event data at source without reliance on native logging.”
• “This allows users to detect, prevent, and alert on malicious requests to a Microsoft Active Directory Domain Controller.”
• “Reconnaissance is the first phase of every targeted attack.”
• “It provides users with access to the ‘Who? What? Where? When?™’ of any event, including the before and after values, complete originating and destination IP Addresses, Host Names, and more.”
• “Consider solutions that include managed services and pre-configured analytics, not just bare tools.”