Authentication Attempt From a Dormant Account

Analytics BIOC Informational

Authentication Attempt From a Dormant Account

A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall traffic Logs, XDR Agent

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Valid Accounts (T1078)

Attacker's goals:

Use a compromised user account that has not been used in a long time and therefore less likely to be noticed.

Investigative actions:

See whether the service authentication was successful. Confirm that the activity is benign (e.g. the user returned from a long leave of absence). Check whether you have issues with your Cloud Identity Engine failing to sync data from Active Directory.

Test period:: N/A (single event)
Deduplication:: 31 Days

1 variation:

Authentication Attempt From a Dormant Account to a sensitive server Low (parent: Informational)