Analytics
Low
✕
Interactive local account enumeration
Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.
- Module:
- Identity Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)
ATT&CK techniques: Account Discovery (T1087) Brute Force (T1110)
Attacker's goals:
Discover valid accounts to gain credentials.
Investigative actions:
Check if the login attempts were part of a legitimate misunderstanding of the system or part of an attack.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day