Which PTA sensors are required to detect suspected credential theft?

To detect suspected credential theft, such as Pass-the-Hash (PtH) or Pass-the-Ticket (PtT) attacks, Privileged Threat Analytics (PTA) requires multiple data sources for a comprehensive analysis. It correlates information from the CyberArk Vault to understand legitimate privileged account activity, analyzes network traffic for anomalous authentication patterns, and ingests security event logs from sources like Domain Controllers. This combination allows PTA to build a baseline of normal behavior and accurately identify deviations that indicate a credential has been compromised and is being used maliciously on the network.

A. Logs, Vault Logs: This option is incomplete. Without the Network Sensor, PTA cannot capture and analyze the network authentication traffic (e.g., NTLM, Kerberos) where attacks like Pass-the-Hash are visible.

C. Logs, PSM Logs, CPM Logs: This is incorrect because PSM and CPM logs detail activities within the CyberArk environment (session activity, password management), not the malicious use of stolen credentials on the broader network.

D. Logs, Network Sensor, EPM: While EPM is a powerful sensor for detecting credential theft attempts on the endpoint, Vault logs are a more fundamental requirement for PTA to correlate network events with the specific privileged accounts managed by CyberArk.

---

1. CyberArk Privileged Threat Analytics Documentation - "Data Sources": The official documentation specifies the data sources PTA uses for its security algorithms. It explicitly lists Vault traffic and logs

network traffic captured via a network sensor (or port mirroring)

and log data from SIEMs or directly from Domain Controllers as key inputs for detecting credential theft.

Reference: CyberArk Privileged Threat Analytics (PTA) Implementation Guide

Version 12.x

Chapter: "System Architecture and Components"

Section: "Data Sources". This section details that PTA receives Vault syslog records

Windows event logs from Domain Controllers

and network traffic data to detect threats.

2. CyberArk Privileged Threat Analytics Documentation - "Credential Theft": The documentation on specific threat detection scenarios highlights that detecting Pass-the-Hash and Overpass-the-Hash requires analyzing network traffic. PTA's Network Sensor is designed for this purpose

capturing authentication packets and forwarding them for analysis. The correlation with Vault data is essential to distinguish privileged from non-privileged activity.

Reference: CyberArk Privileged Threat Analytics (PTA) Security Fundamentals Guide

Version 12.x

Chapter: "PTA Detections"

Section: "Suspected Credential Theft". This section explains that the detection algorithm relies on analyzing authentication traffic from the network and correlating it with user activity data from the Vault and Windows Events.