Detection of the network logon protocol used in pass-through authentication

1. A system, comprising:

at least one processor coupled to a memory;

the at least one processor is configured to:

pair a network packet used to facilitate a pass-through authentication request with an authentication request event logged at a domain controller, wherein the network packet includes an encrypted portion having an encrypted response and an encrypted non-response data;

use a portion of data in the authentication request event to estimate a size of the encrypted non-response data; and

determine a version of a network logon protocol used to facilitate the pass-through authentication request from an estimated size of the encrypted response, wherein the estimated size of the encrypted response is calculated from the estimated size of the encrypted non-response data.

2. The system of claim 1 , wherein the at least one processor is further configured to:

pair the authentication request event with the network packet based on a time associated with the authentication request event and a time associated with the encrypted network packet being within close temporal proximity.

3. The system of claim 1 , wherein the at least one processor is further configured to:

determine an allowed time differential representing a transit time for the network packet to reach a destination from a source of the network packet; and

pair the authentication request event with the network packet based on a time associated with the paired event and a time associated with the encrypted network packet being less than an allowed time differential.

4. The system of claim 3 , wherein the destination is a domain controller or a protocol detection server.

5. The system of claim 1 , wherein the at least on processor is further configured to:

estimate the size of the encrypted response of the network packet from determining a size of variable-length fields in the paired authentication request event.

6. The system of claim 1 , wherein the version of the network logon protocol is NT Lan Manager (NTLM) version one or NTLM version two.

7. The system of claim 1 , wherein the at least one processor is further configured to:

identify from an unencrypted portion of the network packet a second protocol used to transmit the pass-through authentication request to a domain controller.

8. The system of claim 7 , wherein the at least one processor is further configured to:

when the second protocol is a predetermined value, determine a size of select variable-sized fields in the authentication request event; and

use the size of the select variable-sized fields to estimate the size of the first segment in the encrypted portion of the network packet.

9. A method comprising:

correlating, at a computing device, an authentication request event logged in a domain controller with a network packet used to facilitate a pass-through authentication request to a domain controller, the network packet including an encrypted portion representing the pass-through authentication request, the encrypted portion including an encrypted response and encrypted non-response data;

calculating an estimated size of the encrypted response from the size of the encrypted non-response data;

calculating a size of the encrypted non-response data from corresponding data in the correlated authentication request event; and

identifying a legacy version of a network logon protocol used to generate the encrypted response from the estimated size of the encrypted response.

10. The method of claim 9 , further comprising:

correlating the authentication request event with the network packet on a closest temporal proximity of the arrival of the authentication request event and the arrival of the network packet.

11. The method of claim 9 , further comprising:

determining an allowed time differential between a source of the network packet and the domain controller; and

correlating a time of the authentication request event with a time of the network packet within the allowed time differential.

12. The method of claim 9 , further comprising:

determining a size of select fields in the authentication request event; and

using the size of the select fields in the authentication request to determine the size of the encrypted response.

13. The method of claim 9 , wherein the authentication request is associated with event identifier 8004 .

14. The method of claim 9 , wherein the authentication request is associated with event identifier 4776 .

15. The method of claim 9 , wherein the legacy version of the network logon protocol is NT Lan Manager (NTLM) version two.

16. A device, comprising:

a memory coupled to a processor;

wherein the memory contains instructions that when executed on the processor perform actions that:

match an authentication request event logged in a domain controller with a network packet used to facilitate a pass-through authentication request to a domain controller, the authentication request event and the network packet matched on a close temporal basis, the network packet having an encrypted portion containing an encrypted response and encrypted non-response data;

calculate a size of the encrypted non-response data from corresponding data in the authentication request event;

calculate a size of the encrypted response from the size of the encrypted non-response data; and

identify a version of the network logon protocol that facilitated the pass-through authentication request from the size of the encrypted response.

17. The device of claim 16 , wherein the memory contains instructions that when executed on the processor perform actions that:

correlate the authentication request event with the network packet on a closest temporal proximity of the arrival of the authentication request event and the arrival of the network packet.

18. The device of claim 16 , wherein the memory contains instructions that when executed on the processor perform actions that:

determine an allowed time differential between a source of the network packet and the domain controller; and

correlate a time of the authentication request event with a time of the network packet within the allowed time differential.

19. The device of claim 16 , wherein the memory contains instructions that when executed on the processor perform actions that:

upon determining that the identified version of the network logon protocol is a legacy protocol, deter usage of the legacy protocol.

20. The device of claim 16 , wherein the network logon protocol is NT Lan Manager (NTLM).