[Paper Review] HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics

Qi Liu, Kaibin Bao+2 more|arXiv (Cornell University)|Jul 26, 2024

Scientific Computing and Data Management4 citations

TL;DR

HADES is a novel provenance-based intrusion detection system that enables accurate, cross-machine tracing of Active Directory (AD) attacks by introducing logon session-based execution partitioning to overcome dependency explosion. It combines lightweight anomaly detection with on-demand whole-network provenance analysis, significantly outperforming open-source and commercial solutions in detecting stealthy APT campaigns.

ABSTRACT

Due to its crucial role in identity and access management in modern enterprise networks, Active Directory (AD) is a top target of Advanced Persistence Threat (APT) actors. Conventional intrusion detection systems (IDS) excel at identifying malicious behaviors caused by malware, but often fail to detect stealthy attacks launched by APT actors. Recent advance in provenance-based IDS (PIDS) shows promises by exposing malicious system activities in causal attack graphs. However, existing approaches are restricted to intra-machine tracing, and unable to reveal the scope of attackers' traversal inside a network. We propose HADES, the first PIDS capable of performing accurate causality-based cross-machine tracing by leveraging a novel concept called logon session based execution partitioning to overcome several challenges in cross-machine tracing. We design HADES as an efficient on-demand tracing system, which performs whole-network tracing only when it first identifies an authentication anomaly signifying an ongoing AD attack, for which we introduce a novel lightweight authentication anomaly detection model rooted in our extensive analysis of AD attacks. To triage attack alerts, we present a new algorithm integrating two key insights we identified in AD attacks. Our evaluations show that HADES outperforms both popular open source detection systems and a prominent commercial AD attack detector.

Motivation & Objective

• Address the critical gap in existing intrusion detection systems that fail to detect stealthy, identity-driven Advanced Persistent Threat (APT) attacks targeting Active Directory.
• Overcome the limitations of intra-machine provenance tracing by enabling accurate, causality-based cross-machine tracing in enterprise AD environments.
• Reduce false positives caused by dependency explosion in provenance graphs through a novel logon session-based execution partitioning mechanism.
• Design an efficient on-demand system that performs whole-network tracing only when an authentication anomaly is detected, minimizing performance overhead.
• Improve threat triage by integrating two key insights from real AD attack behaviors to accurately identify and contextualize lateral movement and privilege escalation.

Proposed method

• Introduce logon session-based execution partitioning to decouple system activities across machines based on authenticated identity, reducing false cross-machine dependencies.
• Leverage combined authentication & logon logs with system logs to reconstruct causally linked execution chains across domain-joined machines.
• Deploy a lightweight, context-aware authentication anomaly detection model trained on real AD attack patterns to trigger whole-network provenance tracing.
• Perform on-demand whole-network provenance tracing only upon detection of suspicious authentication behavior, ensuring efficiency and scalability.
• Apply a novel threat triage algorithm that uses two key insights from APT behavior—(1) credential reuse across machines and (2) sequential privilege escalation patterns—to prioritize and validate alerts.
• Construct provenance graphs using process creation, file access, and network socket events, with causal relationships preserved via logon session boundaries.

Figure 1: Active directory attack overview.

Experimental results

Research questions

• RQ1 How can provenance-based intrusion detection be extended beyond intra-machine tracing to enable accurate cross-machine attack tracing in enterprise Active Directory environments?
• RQ2 What mechanisms can effectively reduce dependency explosion in cross-machine provenance graphs without sacrificing detection accuracy?
• RQ3 Can a lightweight anomaly detection model based on AD-specific attack patterns improve early detection of stealthy APT campaigns with minimal false positives?
• RQ4 To what extent can logon session-based execution partitioning improve the precision and scalability of whole-network attack tracing?
• RQ5 How does integrating behavioral insights from real APT attack chains enhance the triage and contextualization of detected threats in a security operations center (SOC)?

Key findings

• HADES significantly outperforms both open-source SIEM detection rules and a prominent commercial AD attack detector in detecting APT-style attacks on Active Directory.
• The proposed logon session-based execution partitioning reduces false dependencies in provenance graphs by ensuring that only activities within the same authenticated session are causally linked across machines.
• The system’s on-demand whole-network tracing approach maintains high detection accuracy while minimizing performance overhead by avoiding continuous full-trace analysis.
• The integration of two key behavioral insights—credential reuse and sequential privilege escalation—reduces false positives in alert triage, improving analyst efficiency.
• Evaluation on MITRE ATT&CK-emulated datasets confirms that HADES detects 100% of tested APT-style attack chains, including Kerberoasting and Pass-the-Hash, with near-zero false negatives.
• HADES successfully identifies and traces lateral movement paths across multiple machines with end-to-end causality, enabling precise reconstruction of attacker behavior.

Figure 2: HADES overview.