I'm reviewing activity from an IT administrator account and need to determine whether it reflects legitimate administration or internal reconnaissance. The account generated numerous LDAP queries against domain controllers, USER_ENUMERATION and ENDPOINT_ENUMERATION alerts, many SAMR/DCE-RPC requests across different computers, and several bursts of more than 10 SAMR requests per second. There was also SMB traffic to domain controllers, frequent NTLM authentication to NPS/RADIUS servers, Entra ID and Microsoft 365 sign-ins from multiple IP addresses, a password change, and removal from Domain Admins.
Some of this could be normal helpdesk or administrative work, but the SAMR enumeration spans Finance, HR, factory, and POS systems. For those using identity-monitoring tools, what evidence would you check to distinguish routine administration from a compromised account performing reconnaissance? Which logs or events would help confirm whether lateral movement actually occurred?
4 Answers
The password change and removal from Domain Admins deserve immediate attention because they could be either a legitimate response or an attacker trying to alter access and cover activity. Preserve identity and endpoint logs, identify the source device and IP for every sign-in, and consider temporarily restricting or disabling the account while validating the timeline. Also check whether other accounts, tokens, service principals, or administrative workstations show related activity.
Start with the process and host that generated the activity, not just the account name. Broad, ordered enumeration across many systems is more consistent with a discovery tool or script than with someone manually doing administrative work. Check endpoint telemetry for the executable, command line, parent process, script interpreter, archive or tool creation, and any files dropped around the first burst of activity. A cluster of rapid SAMR requests is especially worth investigating.
To verify lateral movement, look for successful and failed logons on the target machines, especially unusual network logons, explicit-credential use, remote service creation, scheduled tasks, WMI or PowerShell remoting, RDP, WinRM, and admin-share access. Review DC security events, endpoint process trees, SMB file access, Kerberos and NTLM details, and changes to privileged groups. SMB connections to domain controllers can be normal because of policy and directory operations, so the surrounding process and authentication context matter.
Build a timeline for the account over several weeks. Determine whether this behavior is established or appeared suddenly, then correlate it with sign-in locations, device identifiers, MFA events, password changes, group-membership changes, and conditional-access results. Contact the administrator through a trusted channel to verify the work, but don’t treat confirmation alone as proof if the account or workstation may be compromised.
Compare the scope with the systems that administrator normally manages. Activity limited to assigned hosts may be routine; a sweep across unrelated departments and sensitive systems is much harder to explain as ordinary support work.