Analytics BIOC Informational
✕

A user account was modified to password never expires

A user account was modified to password never expires.

Module:
Identity Analytics
Data source:
Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:

An attacker may attempt to gain access to the account.

Investigative actions:

Confirm that the account is not a temporary account that could be exploited by an attacker.* Verify this action with the user who performed the change.* Ensure the organization has a strong password aging policy.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • A sensitive account was modified to password never expires Low (parent: Informational)