1

How is it possible to correlate or detect user logons, e.g. via ssh/rdp, to associate the origin user and target user?

My use case is to know who actually (personal/identifiable) used a technical account (non-personal).

Sidenote: Both clients and both users are in the same network and or at least share the same AD forrest or authentication.

3
  • It is going to depend on what data is available in your logs
    – schroeder
    Commented Jan 24, 2019 at 14:38
  • Take for example windows event logging with Event 4624 User Logon Type 10 (remote connections). Or syslog (eg with process starts for ssh)
    – matcauthon
    Commented Jan 24, 2019 at 15:24
  • What SIEM are you using? It depends on your logs and how they are structured. ie having logs structured in the Universal Event Format (UEF) before sending to InsightIDR..
    – NASAhorse
    Commented Feb 27, 2019 at 21:21

1 Answer 1

2

SIEM correlation rules generally require matching or corresponding attributes in a log in order to link 2 logs together. So one option may be to match on ip addreses. Perhaps it's a timing rule such that a remote (personal) account logs in and a log shows they are assigned an internal ip. Then the rule says that if within 5 minutes that internal ip logs into another system with a different account (technical) then report it to you. Now you have an alert that correlates the personal account to the technical account.

Example:

Log1: vpn says user1 remoted in from 8.8.8.8 & was assigned ip 10.0.0.1

Log2: Linux server says technicalaccount1 ssh'd I'm from 10.0.0.1

Alert: Linux ssh within 5 minutes after vpn login with matching ips

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .