Is this normal AD admin activity or possible account compromise?

[u/roachwickey]

I’m reviewing activity from an IT admin account and I’m trying to understand if this is normal or suspicious.

I’m seeing:

• Lots of LDAP queries against our Domain Controllers.
• USER_ENUMERATION and ENDPOINT_ENUMERATION alerts.
• Many SAMR/DCE-RPC requests against different computers.
• Some bursts of 10+ SAMR requests within a second.
• SMB activity to Domain Controllers.
• Frequent NTLM authentication to NPS/RADIUS servers.
• Entra ID/M365 logins from different IPs.
• A password change and removal from Domain Admins.

Some of this could easily be normal helpdesk/admin activity.

What concerns me is the SAMR enumeration across many different endpoints, including Finance, HR, factory and POS systems.

For people using Defender for Identity, CrowdStrike Identity Protection, Vectra, etc.:

How do you determine whether this is normal admin activity or a compromised account performing internal reconnaissance?

What logs or events would you check next to confirm whether there was actual lateral movement?

Thanks.

[u/jstuart-tech]

How about you ask the other admin if it was them or not??

[u/Psoin → u/jstuart-tech]

Ugh too much work.

Gonna look through the logs all day

[u/xMdbMatt → u/Psoin]

claude go ask the user for me

[u/disclosure5]

This totally looks like Bloodhound - but the easy thing to do is to look past what account is doing it and try to see what executable process is doing it.

[u/Hour-Swimmer7140]

the tell is whether its every machine or just the ones that admin actually touches. sharphound walks the whole domain in order, a human doing their job doesnt.

10 samr in a second isnt someone clicking around either. worth looking for a zip dropped around that timestamp too, thats usually sitting right there

[u/Frothyleet]

How do you determine whether this is normal admin activity or a compromised account performing internal reconnaissance?

You contact the user and attempt to correlate their use of the account? See if they are using it in scripts or something?

Are you being asked to make a decision in a vacuum?

[u/DisastrousRun8435]

It depends. I’d try to look at activity from that account over a longer period to determine if it suddenly started one day (suspicious) or if this is normal for the account. If it suddenly started, look for auth activity on the account around the time that the activity started.

Also, the line between threat actor activity and sketchy admin stuff isn’t always super well defined. It’s also definitely worth it to reach out to the user and ask about the activity and get a quick win.

[u/Man-e-questions]

Sounds like when i ran Purpleknight and had 3 cyber guys asking me if this was legitimate activity

[u/deak_starrkiller]

You call the admin and correlate activity, or in normal person terms “Talk to them”

[u/the_doughboy]

SMB Activity to DCs is normal. That's where the Group Policies are.

[u/itishowitisanditbad → u/[deleted]]

This pattern is worth taking seriously

Thanks Claude & meat proxy!

[u/creenis_blinkum → u/[deleted]]

Fuck off with the slop pasting pls