BitDefender GravityZone XDR Identity Sensor for MDR - subscription license (1 year) - 1 license

Identity security is a critical component in enabling greater cyber resilience. Identifying suspicious authentication activity for applications, DevOps tools, databases, systems, cloud environments, and other critical resources helps prevent or mitigate the potential damage of a cyber-attack. Once the Identity Sensor is connected to Active Directory, it detects activity associated with attacks that attempt to use compromised accounts, tokens, and objects. This includes not only end user accounts but system and API accounts.

The Identity Sensor detects attacks targeting the Kerberos network authentication protocol. Among the detections supported is the ability to detect when a Kerberos login is used to perform brute-force attacks against a system. During a brute-force attack, the malicious actor attempts to use rapidly generated passwords or encryption keys to gain system access. The sensor also detects additional Kerberos-related activities including use of stolen Kerberos tickets to move laterally across a network, requesting tickets with weak encryption - a common sign of malicious intent - and replay attacks. Replay attacks involve stealing packets from the network to forward them to a service or application.

The Identity Sensor also recognizes suspicious logins after a brute-force attack has been detected. The sensor identifies when an attacker registers a rogue Active Directory Domain Controller and uses it to inject malicious objects on other domain controllers within the same Active Directory infrastructure. It identifies when an attacker performs various activities on an Active Directory object and authenticates to remote systems using stolen credentials.

The powerful detection component of the GravityZone XDR Identity Sensor is complemented by capabilities that enable security teams to take meaningful action; for example, security teams can disable an Active Directory account or force a password reset directly from the GravityZone management console.