CSA (312-39) SOC Simulation Lab
Scenario Context
A mid-sized healthcare provider's internal network experienced a security breach. A threat actor escalated privileges and successfully extracted the Active Directory database from a legacy Domain Controller.
Incident Response has recovered an unmanaged staging server on a segmented VLAN where the attacker transferred the exfiltrated database. The threat actor was actively attempting to reverse the dumped NTLM hashes offline to compromise service accounts and pivot into the restricted payment zone.
Security Environment
Review the timeline reconstructed from SIEM events, EDR alerts, and forensic recovery of the attacker's staging machine. Pay close attention to the execution artifacts found during the IR phase.
Context: The attacker extracted the NTDS.dit file using built-in Windows utilities (Living off the Land) to avoid immediate malware blocks, then moved the database to an isolated machine to perform an offline attack without generating login failure noise on the network.
Question
Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.
.rt files found on the staging server. The attacker is trading massive amounts of storage space to eliminate the computational time required to generate hashes on the fly.
Expert Insight
1. What is happening
The attacker executed a classic offline credential dumping attack. First, they abused ntdsutil.exe to dump the Active Directory database (NTDS.dit) and the SYSTEM registry hive. Next, they transferred the hashes to an offline staging server. Instead of guessing passwords live against a domain controller (which triggers Account Lockouts and SIEM alerts), they are cracking the hashes locally using massive precalculated databases.
2. Why the correct answer is correct
B. Rainbow Table Attack is correct. Rainbow tables use precomputed chains of plaintext passwords and their resulting hashes. In our forensic log, the presence of huge .rt (rainbow table) files indicates the attacker is matching the stolen NTLM hashes against these precomputed lists to instantly discover the plaintext passwords. This works exceptionally well against legacy hashes like NTLM or MD5 that lack cryptographic "salt."
3. Why the other options are wrong
- Dictionary Attack (A): Computes hashes on the fly using a simple text file of common words (like `rockyou.txt`). It does not use precomputed hash values to save time.
- Bruteforce Attack (C): Systematically computes the hash for every possible character combination on the fly. It is extremely slow compared to a precomputed lookup.
- Syllable Attack (D): A hybrid approach that combines syllables or parts of words to guess passwords on the fly. It is a variation of a dictionary attack, not a precomputed table.
MINI LESSON: Detecting Offline Cracking Operations
As a SOC Analyst, you cannot detect offline password cracking directly because the attacker is performing the computations on their own hardware. Therefore, your detection engineering must focus on the acquisition phase of the attack lifecycle:
- Monitor Built-in Tools (LoLBin abuse): Alert on command-line parameters indicating AD database dumping. Specifically, watch for
ntdsutil * ifm * create,vssadmin create shadow, andreg save HKLM\SAM. - LSASS Access: Ensure your EDR is configured to alert on unauthorized processes requesting read access to the
lsass.exememory space (commonly done by Mimikatz). - Defensive Mitigation: Rainbow tables are defeated by "salting" hashes (adding random data to the password before hashing). While you can't easily salt legacy NTLM, modernizing authentication protocols (like Kerberos AES) heavily mitigates this specific technique.
Ready to master more real-world SOC concepts?
Explore more CSA simulations