A county SOC believes an attacker is hopping from a clerk workstation onto file shares with stolen domain credentials rather than new malware. Which data source is most useful for confirming lateral movement via valid accounts?
Select an answer to reveal the explanation.
Short Explanation
Stolen passwords look like ordinary logons, so you hunt the attendance sheet, not the malware bucket. Domain-controller Security logs are that sheet for who authenticated where on the county domain. CMS errors and pump-runtime archives will not show a valid-account hop.
Full Explanation
Confirming lateral movement via stolen domain credentials—hopping from a clerk workstation onto file shares without new malware—depends on authentication evidence. Windows Security authentication logs from the county domain controllers are the most useful primary source: logon type, account, source workstation, and destination service reconstruct valid-account reuse across the civic domain. File-share access events on servers complement domain controllers, but DC authentication logs remain the backbone for T1078-style movement.
Public-website CMS error logs for the permitting portal speak to web application errors, not Kerberos or NTLM lateral movement. Wastewater historian analog archives measure pumps and process values, not domain logons. Parks kiosk antivirus quarantine counts without logon fields cannot confirm Valid Accounts hopping and may miss credential abuse entirely when no new malware dropped.
Exam caveat: valid-account lateral movement points first to authentication from domain controllers or equivalent; malware counts and OT analogs are wrong evidence classes.
Operational check: search Authentication for the stolen account from the clerk workstation toward file-server destinations, note logon types and times, annotate T1078 in Enterprise Security, and do not rely on antivirus quarantine counts alone.