Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Company
Platform
Modern NDR
Resources
Company
DETECTION OVERVIEW
Risk Factors
An attacker can acquire legitimate account credentials through brute force or other techniques. With these credentials, the attacker can take advantage of the privilege levels associated with the account to access files. If sensitive files are not properly configured with the appropriate permissions, an attacker might gain unauthorized access with stolen credentials.
The system might change the risk score for this detection.
Kill Chain
$source received an excessive number of errors with the SMB status code, STATUS_BAD_IMPERSONATION_LEVEL. This detection indicates that $source has an invalid impersonation level, or does not have the required impersonation level. Client impersonation is part of client/server access control. Impersonation levels define operations a server can perform in the context of $source's identity. Investigate to determine if $source is compromised and attempting to access unauthorized files or directories.
The SMB protocol grants user-level access to file shares based on a username and password. With stolen user credentials, an attacker can attempt to access file servers and shares. Likewise, an employee might also try to gain unauthorized access to a file server with their restricted credentials. By sending SMB session requests from various accounts, the attacker can discover which file servers are available to each user. An attacker can then leverage higher-privileged accounts to accomplish the later steps of their attack.
Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.
ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response
Visit this resource for more information.
This analysis exposes the critical link between an organization's lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.
Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.
Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.
