HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics

1. Problem Statement

Active Directory (AD) is the backbone of identity and access management in modern enterprises, making it a primary target for Advanced Persistent Threat (APT) actors. Attackers utilize "Living-Off-the-Land Binaries" (LOLBins) and "low and slow" strategies to evade detection.

• Limitations of Conventional IDS: Traditional Intrusion Detection Systems (IDS) rely on isolated event analysis or signature matching. They struggle with stealthy attacks using legitimate tools (LOLBins), resulting in high false-negative rates.
• Limitations of Existing Provenance IDS (PIDS): While provenance-based systems (which build causal graphs of system activities) reduce false positives, they are currently restricted to intra-machine tracing. They lack the ability to track attackers across multiple machines in a network.
• The Dependency Explosion Problem: Naively connecting intra-machine provenance graphs based on network connections or simple logon events creates "dependency explosion." This results in massive graphs filled with false dependencies (correlations rather than causality), making it impossible to accurately trace the true scope of an attack or identify privilege escalation.

2. Methodology: The HADES System

HADES is a two-stage, on-demand provenance-based intrusion detection system designed specifically for AD environments. It operates only when an anomaly is detected to ensure efficiency.

Stage 1: Lightweight Authentication Anomaly Detection

• Goal: Identify potential AD attacks to trigger the expensive tracing process.
• Mechanism: The system analyzes Authentication & Logon logs (from Domain Controllers and hosts) to detect anomalies in the Kerberos authentication flow.
• Anomaly Patterns: It identifies specific deviations in the standard 6-step Kerberos process (e.g., AS-REP Roasting, Kerberoasting, Pass-the-Ticket, Golden/Silver Ticket attacks).
• Output: If an anomaly is detected, it generates a High-Level Attack Graph containing involved entities (users, hosts) and a suspected attack type.

Stage 2: Logon Session-Based Execution Partitioning and Tracing

This is the core innovation of HADES. Instead of connecting graphs based on network packets, HADES uses Logon Session IDs to establish true causality.

• Logon Session-Based Partitioning: Windows assigns a unique Logon Session ID to every successful authentication. HADES uses this to partition system activities, ensuring that only activities belonging to the same true identity are linked.
• Overcoming Challenges:
  • Remote Access Type Inference: Different access types (RDP, SMB, SSH, PowerShell) generate logon events differently. HADES infers the access type to correctly interpret session data.
  • Session ID Reassignment: In cases like RDP (Fast User Switching) or Web-Shell access, new activities might be incorrectly labeled with an existing system session ID (e.g., 0x3e7). HADES reassigns these to the correct attacker session ID to prevent false dependencies.
  • Session Linking: It links related sessions (e.g., a privileged UAC session and a standard session created by the same user) to ensure a complete trace.
• Tracing Process:
  1. Forward Tracing: Traces system activities within the logon session on the accessed host.
  2. Cross-Machine Tracing: Uses authentication logs to link the current session to the source session on the attacking machine (backward) and any subsequent sessions on other machines (forward).
  3. Output: A Low-Level Whole Network Attack Graph showing the full attack chain, including lateral movement and privilege escalation.

Threat Score & Triage

To prioritize alerts, HADES calculates a Threat Score based on:

1. Credential Access: Frequency and severity of techniques (e.g., accessing lsass.exe).
2. AD Discovery: Frequency of reconnaissance steps.
3. Privilege Escalation: Detection of token elevation.
4. Context: Weighting factors for Domain Admin involvement and specific attack types (e.g., Golden Ticket is weighted higher than Silver Ticket).

3. Key Contributions

1. First Cross-Machine PIDS for AD: HADES is the first system to perform accurate, causality-based cross-machine provenance tracing in enterprise AD environments.
2. Logon Session-Based Execution Partitioning: A novel concept that uses Windows Logon Session IDs to solve the dependency explosion problem, filtering out noise and false dependencies caused by concurrent user sessions.
3. Lightweight Anomaly Detection Model: A detection model rooted in deep analysis of AD authentication flows that triggers the tracing system only when necessary.
4. Comprehensive Alert Triage: An algorithm that integrates insights from AD attack patterns (Discovery → Credential Access → Lateral Movement) to rank alerts by severity.
5. Robust Implementation: A prototype that handles complex scenarios like RDP session reuse, UAC privilege separation, and various remote access types without requiring code instrumentation.

4. Evaluation Results

The authors evaluated HADES using datasets derived from three MITRE ATT&CK emulation plans: APT29 (Golden Ticket), WizardSpider (Kerberoasting), and Oilrig (Pass-the-Hash).

• Comparison with SIEM Rules (Elastic, Sigma, Chronicle):
  • False Positives: HADES reduced false positives by 98% compared to open-source SIEM rules. SIEM rules struggled with LOLBins, generating thousands of false alerts.
  • False Negatives: HADES detected all true attacks, whereas some SIEM rules missed specific attack instances due to overly specific rules.
• Comparison with Commercial Detector (CAD):
  • The commercial product had zero false positives but a high false negative rate, missing all three attack types in the evaluation. The vendor confirmed that their detection logic had known issues with Pass-the-Hash and lacked sufficient system log visibility.
• Performance:
  • Stage 1: Detects anomalies in <35ms per event.
  • Stage 2: Generates a full network attack graph with threat scores in <45 seconds per alert.

5. Significance

• Bridging the Gap: HADES bridges the gap between the high precision of provenance analysis and the necessity of cross-machine visibility in modern enterprise networks.
• Operational Efficiency: By using an on-demand, two-stage approach, it avoids the computational cost of continuous whole-network tracing, making it viable for large-scale deployment.
• Actionable Intelligence: The system produces attack graphs that are not only explainable but also context-rich, allowing Security Operations Centers (SOCs) to understand the full scope of an attack (from initial access to lateral movement) and prioritize remediation based on threat severity.
• Defense Against APTs: It specifically addresses the "low and slow" nature of APTs that use legitimate tools, which traditional signature-based systems fail to catch.