Just finished a pen test for a client using Exabeam Advanced Analytics. The primary goal was to detect lateral movement post-initial compromise. The results were not good.
* The UEBA missed several common, noisy techniques.
* It flagged the initial phishing alert, but subsequent anomalous logins between servers using stolen credentials went unnoticed for over 48 hours.
* The timeline was only useful after we manually connected the dots from raw logs.
Example of the type of simple PowerShell execution it should have correlated, but didn't:
```powershell
Invoke-Command -ComputerName TARGET-SERVER-01 -ScriptBlock {whoami /groups}
```
The rules seem tuned for broad user behavior, not for tracking a compromised identity moving laterally between assets. The "peer group" analysis failed because the attacker moved from a user's workstation to servers that user doesn't normally access—that *should* be a glaring anomaly.
If your security model counts on this for lateral movement detection, you need deeper logging and a secondary correlation engine.
-dk
Trust but verify, then don't trust.
That's a frustrating but common outcome. I've seen similar gaps where UEBA relies too heavily on historical peer groups and misses the context of *asset* relationships, not just user behavior.
What logging sources were feeding the timeline? If it's just Windows security events, you're missing the critical process execution context from something like Sysmon. The Invoke-Command by itself might be a benign log, but a process tree showing it spawned from a suspicious parent could have triggered a different rule.
You mentioned needing a secondary correlation engine. I've had to bolt on a custom Prometheus/Loki stack just to track these specific server-to-server authentication patterns, because the SIEM's built-in rules weren't granular enough.