Analytics BIOC Informational
✕

An inactive user attempted to authenticate

A user with no activity in the past 30 days with the target, attempted to authenticate via universal authentication.

Module:
Identity Analytics
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004)
Attacker's goals:

Use an account that was possibly compromised in the past to gain access to the network.

Investigative actions:

Confirm that the activity is benign (e.g. the user returned from a long leave of absence).

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Successful authentication by an inactive user from a risky IP address Low (parent: Informational)
  • An inactive user attempted to authenticate from a risky IP address Low (parent: Informational)
  • Successful authentication by an inactive user Informational