Monitoring the wrong things
Feb 24th, 2023 by Jesper Kråkhede
In my last post I described AdminSDHolder, an object in Active Directory that attackers can change to keep their access. One change, in one place, and very few organisations monitor it.
At the same time, the same organisations often pay a lot to monitor things that rarely matter. Every firewall flow, every successful logon to every file share, every antivirus update. Gigabytes per day, stored and paid for, with very little value during an incident.
This is a resource problem. Monitoring costs money in licences and storage, but even more in people. Every alert needs someone to look at it. If the SOC drowns in noise, it has no time for the few signals that really matter. And when budgets are tight, the instinct is to cut the number of analysts, not the amount of noise.
So for management: ask your security team for the list of what is monitored and why. Then ask a different question: what are the ten changes in our environment that would mean we are seriously compromised? Changes to privileged groups, to AdminSDHolder, to Group Policy, to the federation settings, new admin accounts in the cloud. Are those monitored, and does someone act on them within minutes?
If not, move the money. It is usually cheaper to monitor less, but better.
The cost of monitoring isn´t the logs. It is the attention.