Install Indicators of Attack

1. In Tenable Identity Exposure, click System on the left menu bar and the Configuration tab.

   The Configuration pane appears.

2. Click Indicators of Attack.

   The IoA configuration pane appears.

   

3. In (1) Domains Configuration, click See Procedure.

   A procedure window opens.

   

4. Under Future automatic updates?:

   • The default option Enable allows Tenable Identity Exposure to update automatically your IoA configuration whenever you modify it in Tenable Identity Exposure in the future. This also ensures continuous security analysis.

   • If you turn off this option, a message asks you to turn it on to get automatic future updates. Click See procedure and toggle to Enable.

5. Click Download to download the script to run for each domain (Register-TenableIOA.ps1).

6. Click Download to download the configuration file for the domains (TadIoaConfig-AllDomains.json).

7. Click to copy the Powershell command to configure your domains.

8. Click outside the procedure window to close it.

9. Open a PowerShell terminal with administrative rights and run the commands to configure your domain controllers for IoAs.

   Note: The service account you use to install IoAs and to query the domains must have write permissions in Tenable Identity Exposure (formerly known as Tenable.ad) GPO folder. The installation script adds this permission automatically. If you remove this permission, Tenable Identity Exposure shows an error message and automatic updates no longer work. For more information, see Indicators of Attack Installation Script.

1. In the IoA configuration pane, under IoA Setup, select the IoAs you want in your configuration.

   

   Tip: The Zerologon Exploitation Indicator of Attack (IoA) dates from 2020. If all of your domain controllers (DCs) received updates within the past three years, they are protected from this vulnerability. To determine the required patches for securing your DCs against this vulnerability, consult the information in Netlogon Elevation of Privilege Vulnerability from Microsoft. Once you've confirmed your DCs' security, you can safely deactivate this IoA to avoid unnecessary alerts.
   

2. Click Save.

   • If you enabled Future automatic updates, Tenable Identity Exposure saves and automatically updates your new configuration. Allow a few minutes for this update to take effect.

   • If you did not enable Future automatic updates, a procedure window appears to guide you To configure domains for IoAs:

1. In Group Policy Management, check that the new Tenable Identity Exposure GPO exists and it links to the Domain Controllers OU:

   

2. Go to the path C:\Windows\SYSVOL\sysvol\alsid.corp\Policies\{GUID}\Machine\IOA and check that the .gz file exists for all domain controllers before you test the IoAs:

   

1. In the file manager, go to \\<DNS-NAME>\sysvol\<DNS-NAME>\Policies\{<GPO-ID>}\Machine\.

2. Right-click on the "IOA" folder and select Properties.

3. Select the Security tab and click Advanced.

4. Click the Effective Access tab.

5. Click Select a user.

6. Type <TENABLE-SERVICE-ACCOUNT-NAME> and click OK.

7. Click on View effective access.

8. Check that the "Write" permission is activated.

Alternately, you can use Powershell:

• Run the following commands:

Copy

Install-Module -Name NTFSSecurity -RequiredVersion 4.2.3

Copy

Get-NTFSEffectiveAccess -Path \\<DNS-NAME>\sysvol\<DNS-NAME>\Policies\{<GPO-ID>}\IOA\ -Account <TENABLE-SERVICE-ACCOUNT-NAME>

To avoid false positive attacks or lack of detection of legitimate attacks, you must calibrate your IoAs according to your environment by adapting them to the size of your Active Directory, whitelisting known tools, etc.

1. See the Tenable Identity Exposure Indicators of Attack Reference Guide for information about the options and recommended values to select.

2. In the security profile, apply the options and values to each IoA as described in Customize an Indicator.

The following error messages can appear during the deployment: