What Happens When Attackers Blend In? Testing Microsoft Sentinel UEBA Against Real-World Threats

What Happens When Attackers Blend In? Testing Microsoft Sentinel UEBA Against Real-World Threats

Introduction

What happens when an attacker doesn't deploy malware but instead uses legitimate credentials, steals passwords from memory, or abuses trusted administrative tools to blend in with normal activity?

Traditional Security Information and Event Management (SIEM) solutions often rely on predefined rules and signatures to identify threats. While effective against known attack patterns, these approaches can struggle when malicious activity closely resembles normal user behavior.

To explore this challenge, I conducted a project focused on Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) capability. Using a controlled lab environment, I tested whether behavioral analytics could identify suspicious activity that might otherwise bypass traditional rule-based detections.

About Me

My name is Zyquis Collins, and I am an aspiring cybersecurity professional with a background as a competitive basketball player.

Basketball taught me the value of discipline, preparation, teamwork, and studying opponents to gain a competitive advantage. Those same principles apply directly to cybersecurity, where defenders must understand attacker behavior, identify weaknesses, and continuously adapt to emerging threats.

This project represents my first contribution to the cybersecurity community. Through this research, I explored how behavioral analytics can strengthen threat detection and improve security visibility beyond traditional monitoring methods.

Project Overview

To evaluate Microsoft Sentinel UEBA, I integrated telemetry from:

• Active Directory
• Sysmon-monitored endpoints
• Azure Log Analytics
• Microsoft Sentinel data connectors

I then used Atomic Red Team to simulate three MITRE ATT&CK techniques commonly associated with real-world intrusions:

• T1078: Valid Account
• T1003: Credential Dumping
• T1047: Windows Management Instrumentation (WMI)

The goal was to determine whether Microsoft Sentinel could establish behavioral baselines, generate meaningful risk scores, and identify suspicious activity that appeared legitimate at first glance.

The First Lesson: Data Quality Matters

One of the biggest challenges I encountered was assuming that enabling UEBA would immediately produce useful detections.

Early testing produced weaker results than expected because I focused on enabling the feature before validating log sources, data connectors, and telemetry collection. Missing authentication and endpoint data limited Sentinel's ability to establish accurate behavioral baselines.

To resolve this issue, I:

• Verified Active Directory log ingestion
• Validated Sentinel data connectors
• Reviewed telemetry collection
• Improved Sysmon logging configurations

This process reinforced an important lesson:

Behavioral analytics are only as effective as the data they receive.

Experiment 1: Valid Accounts (T1078)

Objective

Evaluate whether Microsoft Sentinel UEBA could detect suspicious use of legitimate credentials.

What Happened

The attack simulation involved logging in with a valid account outside normal operating patterns.

Initially, I made the mistake of performing the login from the same workstation during normal business hours. I assumed any suspicious login attempt would automatically generate a UEBA alert.

However, Sentinel generated little meaningful activity because the behavior closely matched the user's normal baseline.

How I Fixed It

After reviewing UEBA documentation and collected logs, I modified the test by:

• Using a different workstation
• Using a different source IP address
• Logging in outside normal operating hours

These changes better reflected the behavior of a compromised account and resulted in increased risk scores and behavioral anomalies.

Key Takeaway

UEBA focuses on behavioral deviations, not simply successful authentication events.

Experiment 2: Credential Dumping (T1003)

Objective

Determine whether Microsoft Sentinel UEBA could identify credential dumping activity.

What Happened

Using Atomic Red Team, I simulated credential dumping against a monitored endpoint.

I initially expected Sentinel to generate immediate detections. Instead, alerts and risk indicators were limited, making me question whether the simulation had executed correctly.

How I Fixed It

Further investigation revealed that Sysmon was not collecting enough credential-access and process creation telemetry to provide adequate visibility.

To address this issue, I:

• Expanded Sysmon monitoring rules
• Verified event ingestion into Log Analytics
• Confirmed telemetry was reaching Sentinel
• Reviewed analytics rules related to credential-access activity

Results

After improving telemetry collection, Sentinel generated stronger detections and more meaningful behavioral insights.

Key Takeaway

Detection quality depends heavily on telemetry quality.

Experiment 3: Windows Management Instrumentation (T1047)

Objective

Evaluate whether Sentinel could identify suspicious WMI activity that might resemble legitimate administrative behavior.

What Happened

At first, I assumed any WMI-related activity would appear suspicious.

After running the simulation, however, Sentinel produced little alerting. Because the activity originated from a known administrator account on a familiar workstation, the behavior appeared normal from a behavioral analytics perspective.

How I Fixed It

To create a more realistic attack scenario, I:

• Simulated remote WMI activity
• Generated uncommon administrative actions
• Verified WMI-related Sysmon events were being collected
• Repeated testing under more suspicious conditions

Results

The revised simulation generated stronger behavioral anomalies and more useful UEBA findings.

Key Takeaway

Context matters. Administrative tools are not inherently suspicious; how they are used determines the level of risk.

Final Findings

Across all three experiments, a common theme emerged: Microsoft Sentinel UEBA performs best when high-quality telemetry and meaningful behavioral deviations are present.

The experiments demonstrated that Sentinel can enhance visibility into:

• Account compromise activity
• Credential theft attempts
• Living-off-the-land techniques
• Behavioral anomalies that traditional signatures may miss

At the same time, the project highlighted that behavioral analytics is not a "set it and forget it" solution. Effective detection requires accurate data, proper configuration, realistic testing, and ongoing tuning.

The Coolest Thing I Learned

The most interesting discovery was seeing how UEBA evaluates behavior rather than simply matching attack signatures.

Initially, I expected Sentinel to alert whenever a suspicious command or technique was executed. Instead, I learned that UEBA focuses on understanding what is normal for a user or system and identifying meaningful deviations from that baseline.

This approach provides a level of context that traditional rule-based detections often lack.

One Piece of Advice

If you're building a Sentinel lab or conducting a similar project, verify your logging before running any tests.

It's easy to assume a detection failed when the real issue is missing telemetry. Validate your data connectors, review incoming logs, and confirm events are appearing in Log Analytics before beginning any attack simulations.

Doing so will save significant troubleshooting time and produce more reliable results.

My Favorite Resource

My favorite resource throughout this project was the MITRE ATT&CK Framework.

MITRE ATT&CK provided detailed information about attacker techniques, detection strategies, and realistic adversary behaviors. It helped me design meaningful simulations and ensured the experiments aligned with real-world threats rather than theoretical scenarios.

Acknowledgments

I would like to thank my tutors for their guidance and feedback throughout this project. Their insights helped me better understand complex concepts and improve my approach to testing and analysis.

I would also like to thank my learning coach for their continued support, encouragement, and regular check-ins throughout my cybersecurity journey.

References

• Microsoft. (2024). Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel. Microsoft Learn. https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics

• Microsoft. (2024). Microsoft Sentinel User and Entity Behavior Analytics (UEBA) reference. Microsoft Learn. https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference

• Microsoft. (2024). Sysmon Overview. Microsoft Learn. https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/overview

• Microsoft. (2024). Sysmon. Sysinternals. Microsoft Learn. https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

• MITRE ATT&CK. (2024). T1078: Valid Accounts. MITRE Corporation. https://attack.mitre.org/techniques/T1078/

• MITRE ATT&CK. (2024). T1003: OS Credential Dumping. MITRE Corporation. https://attack.mitre.org/techniques/T1003/

• MITRE ATT&CK. (2024). T1047: Windows Management Instrumentation. MITRE Corporation. https://attack.mitre.org/techniques/T1047/

• MITRE ATT&CK. (2024). Detection Strategy DET0364: Windows Management Instrumentation Abuse. MITRE Corporation. https://attack.mitre.org/detectionstrategies/DET0364/

• Red Canary. (2024). Atomic Red Team. https://www.atomicredteam.io/

• Red Canary. (2024). Atomic Red Team GitHub Repository. https://github.com/redcanaryco/atomic-red-team

• National Institute of Standards and Technology. (2024). Cybersecurity Framework (CSF) 2.0. https://www.nist.gov/cyberframework

• National Institute of Standards and Technology. (2024). Computer Security Resource Center (CSRC). https://csrc.nist.gov/