Analytics BIOC Informational
✕

Interactive login by a machine account

A machine account performed an interactive or remote interactive login.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that has access to resources to move laterally in the network and access privileged resources.

Investigative actions:

See whether the login was successful. Check whether the account has done any administrative actions it should not usually do. Look for more logins and authentications by the account throughout the network.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Successful interactive login by a machine account Low (parent: Informational)