LDAP from iData agent

Hey @Henke!  Without giving actual server names, can you confirm who this client is making the requests to?  Is it the Commserve?  A webserver?

I would start with CVD.log for the specified times (factoring in the time zone of the security log vs the client or other servers) as a start.

What iDa is on that client?  That would help build some context as well.

Thanks!

Hey @Mike Struening, it’s sending the request to one of the domain controllers.It has the AD iData agent so it would make perfect sense for it so send the request.

I’ll have a look in the Cvd.log on the client, thanks.

//Henke

Ah, yeah that makes perfect sense.  I was thinking perhaps an exchange agent, but AD makes sense for sure.

Keep me posted!

Hey @Henke , any luck on the CVD log messages?

Thanks!

@Mike Struening ,no luck in that log on the client what I could see.

//Henke

Where is the source of the LDAP query that is being made to the DC with the AD ida installed on it? 

Appreciate the reply.  

Quick clarification:

Which machine is the SENDER and which is the RECIPIENT?

Is that the Commserve sending to the Active Directory iDA client?

Want to be sure we are checking the right servers with the proper expectations.

Thanks!

@Henke , want to keep this thread alive.  any luck on checking the sender and recipient?

@Mike Struening The source is Commserve and recipient is one of the Domain controllers.

Below is a snippet from the alert message after detection.

Workspace: [Medium] Security principal reconnaissance (LDAP)

Security principal reconnaissance (LDAP) was detected in "domain"

An actor on COMMSERVE sent suspicious LDAP queries to GLOBAL-DOMAINCONTROLLER, searching for Records Management

//Henke

Like you, I’m sure it is legit though you want to have some log file proof I imagine 

I’ll share this thread with some people here for advice.

@Henke , is there any LDAP Server setup in your commserver like a Microsoft AD server etc ? that would make LDAP queries to the Domain Controllers, during user discovery for logins etc. You can check the commserver evmgrs logs if you have an AD setup for authentication.

@Henke , have you had a chance to review @MaheshPrakash ‘s response?

@Mike Struening@MaheshPrakash Yes we have AD integration. Though I wasn’t able to find any ldap references in Evmgrs log file.

@Henke , I hate to go this route, but it’s probably best to open a support case here.  Let me know if you do and I’ll track the incident and resolution to update this thread.

With SSO enabled, the CS will query AD using LDAP.
Increase debug level for EvMgrS.log to see in the log.
 

Thank you all that contributed.

I’ll drop this for now, if I pick it up again I will let you know.

Thanks

//Henke

Appreciate it, @Henke .  If you reactivate the thread, I’ll unmark the answer.

@Mike Struening how do I reactivate the thread?

Any reply will do (I’m monitoring for all activity).  Once you reengage, I’ll adjust the Best answer showing it is not solved.