Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0001 ✕

Download CSV Show ATT&CK heatmap
  • Unusual user account unlock Informational Identity Analytics 1 variation

    A user unlocked an account. This user does not usually unlock user accounts.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Valid Accounts (T1078)
    Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)
    Attacker's goals: An attacker may unlock a user account to gain unauthorized access.
    Investigative actions: Investigate the associated authentication attempts and login failures (e.g. 4625, 4776 events). Check if the user is authorized to unlock accounts. Confirm that the user unlock was expected. Monitor services that may be running with a user's credentials, resulting in lockouts.

    Variations

    Unusual sensitive user account unlock

    Low overridden

    A user unlocked a sensitive account. This user does not usually unlock user accounts. overridden