Analytics BIOC Informational
✕

A rare local administrator login

A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:

The attacker attempts to change sensitive settings on the host.

Investigative actions:

Check for any other suspicious activity related to the host and the user involved in the alert.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Suspicious local administrator login Low (parent: Informational)