Analytics BIOC
Informational
✕
A disabled user attempted to log in
A disabled user attempted to log in.
- Module:
- Identity Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:
Use an account that was possibly compromised in the past to gain access to the network.
Investigative actions:
Confirm that the activity is benign (e.g. the user was recently enabled by an authorized entity). Check whether you have issues with your Cloud Identity Engine failing to sync data from Active Directory. Monitor services that may be running with a disabled user's credentials.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Cached interactive login attempt by a disabled user Informational