0

I have an alert for monitoring windows server logon success (event ID 4624) and already whitelisting all the authorized users in the alert rule but after a while, there is some alert showed up using domain NT AUTHORITY with account names like SYSTEM and some MSSQL services account with domain NT Service Logon. The logon type 5 (if I'm not mistaken this logon type is a service start) and from my research is NT AUTHORITY are some kind of the Local System account for Windows and it is safe because it was a built-in user.

Is it 100% safe to whitelist those accounts? or there are some threats that can occur from those accounts?

1 Answer 1

0

NT AUTHORITY means the local machine's built-in service accounts. The best known of these is the SYSTEM account - which runs everything from the login screen to most of the high-privilege background services - but there are others by default such as LocalService and NetworkService (more restricted than SYSTEM and used to run background services that don't require enough access to completely take over the OS). NT Service Login (also just known as SERVICES) is for user-installed service accounts. Broadly speaking, a service account is any account which can be used as the principal for a non-interactive service process (most of them also disallow local or remote user login, to reduce attack surface). Whenever a Windows Service starts (this includes all the things listed in services.msc but also stuff like drivers), the Service Control Manager (or SCM, running in services.exe, which itself runs as SYSTEM) creates tries to create a security Token for the service's defined user - which may be one of the built-ins or any other service-login-allowing user - via a system call that gets logged as a service login attempt (this is what you're seeing). If the call succeeds, the SCM launches the service's process using that Token.

To answer your question:

It's only safe to whitelist these accounts to the degree that you are sure nobody can install a malicious service that uses them. Installing a service is simple - it's a few API calls to the service control manager, or just a few registry edits followed by a reboot, and many software installers will do it - but both options require either Administrator-level privileges or some way to bypass ACLs (such as offline access to an unencrypted OS volume). Because installing a service requires high privileges, any user with such privileges can configure any service to run under any account.

1
  • Thank you for the answer, I think I will discuss it with my supervisor first is it okay to whitelist NT Authority account. But first, of course, we will make sure that no one can install malicious services as you suggest.
    – zapdos3
    Apr 22, 2020 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.