1

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of faulure audits wich is an obvious dictionary attack with it cycling through users in alphabetical order. The workstation name was the same server that hosts the domain controller. Also the logon porcess was advapi. This stopped

In addition to this I have a large volume of MSExcahnge AL informations statements in the exchange application logs. 20-30 a second. Ldap operations, search of directory, and completed call to policy group provider.

What could be causing this and how to prevent it. We have consistent antivirus protections across the network and have run quick anti-malware on this server.

If there is anything I need to clarify please let me know. I am relatively new to active directory and exchange.

Thanks

Improve this question

1 Answer 1

Reset to default
0

If you are sure it's brute force/dictionary based attack against Domain controller authentication, anti-virus may not help you here. Anti-virus works on signature based strategy where as unsuccessful authentication attempts (part of attack) are just normal connection attempt without carrying any malicious data in them. So anti-virus or malware scanner will not be able to get you any information about that.

You should try finding source workstation/domain member which is launching brute force attack against your DC. And further investigation should be launched who's using that workstation depending upon attack times, valid/invalid use of creds whether it is by an internal authorized user or someone on the network trying to launch attack from unauthenticated perspective.

You can prevent this by host based intrusion detection capability where such mass attempts should be blocked by IP address or any network monitoring software that should tell you spike in traffic towards domain controller from a particular source.

Improve this answer
3
  • What would you recoomend is the best way to identify the source. What is odd is some of the failure audits come from the domain controller according to the event logs. I have identified one workstation that was also making an astronomical number of requests and removed it from the network but the speed exists. We have also noticed that it is timed and not constant. It will go for about an hour then stop. We have pointed etherape to monitor the domain so we can see any excessive transmission between the two. Is there anything else or a better way to identify the origin of the attack?
    – h8a
    Mar 22, 2013 at 12:54
  • This eneded up being a brute force on the OWA that didnt have any domain info so is was not a huge threat. We did however work with users to update the password policy. In addition the network speed issues were not related, but caused when Trend Micros Web repututation service had failed and was creating issues when trying to resolve any dns.
    – h8a
    Mar 25, 2013 at 14:42
  • thanks, I learnt a bit as well. Sometimes issues are caused by related services, so best way is to start from base ground. i.e. keep wireshark/packet analyzer handy, do some exercises on log analysis and that should help in drilling down the scope during an incident just to prepare a layout to start with. hope my previous reply helped you!
    – user20996
    Apr 19, 2013 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .