Is Netwintess able to decrypt Activity Director traffic?

[JeffersonRodrig]

Hello Everyone!

About RSA Netwitness Decrypt packets, do you know if Packet Decoder is able to open/decrypt LDAP/Kerberos connections from incoming traffic?

I just need to know because I am planning to open this kind of traffic to create news detection based on Activity Directory traffic, such as BloodHound, DCSync, Kerberoasting and etc.

Thanks!

[drewjc]

Hi JeffersonRodrig

NetWitness in general can't decrypt anything without having encryption keys imported. There is no inline decryption. The only protocol where decryption works is for very basic TLS that isn't using ephemeral key exchange (i.e. session keys) and only after you import the keys.

Decryption of Microsoft application protocols isn't supported either, due to the aforementioned key issue. However, NetWitness can parse the clear-text portions of Microsoft protocol traffic to a large enough extent to write detections for some of the common AD attacks (e.g. DCSync).

Good Luck with your project.