Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0003 ✕ technique: T1098 ✕

Download CSV Show ATT&CK heatmap
  • User account delegation change Informational Identity Analytics 2 variations

    A user account was modified with delegation to a service.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)
    Attacker's goals: An attacker may attempt to control an Active Directory environment.
    Investigative actions: Verify this action with the user who performed the change. Check if the account modified is a service account. Follow actions by the user, including TGT and TGS requests. Monitor for anomalous Kerberos activity.

    Variations

    User account delegation to KRBTGT

    High overridden

    A user account was modified with delegation to the KRBTGT service. overridden

    User account delegation to a DC

    Low overridden

    A user account was modified with delegation to a service on a domain controller. overridden