A county SOC believes an attacker is hopping from a clerk workstation onto file shares with stolen domain credentials rather than new malware. Which data source is most useful for confirming lateral movement via valid accounts?
Select an answer to reveal the explanation.
Short Explanation
Stolen passwords look like ordinary logons, so you hunt the attendance sheet, not the malware bucket. Domain-controller Security logs are that sheet for who authenticated where on the county domain. CMS errors and pump-runtime archives will not show a valid-account hop.
Full Explanation
Lateral movement that reuses valid domain credentials is visible primarily in authentication telemetry, especially Windows Security events on domain controllers. A Splunk Enterprise Security investigation of that TTP should start with Authentication-model or WinEventLog:Security data rather than malware, CMS, or OT historian sources. Those other sources can support different hypotheses, but they do not bind account-to-host hops across Active Directory. Choosing the DC authentication source is the Domain 3.1 judgment for valid-account movement.