Analytics BIOC Low
✕

Interactive login by a service account

A service account performed an interactive or remote interactive login.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that has access to resources to move laterally in the network and access privileged resources.

Investigative actions:

See whether the login was successful. Check whether the account has done any administrative actions it should not usually do. Look for more logins and authentications by the account throughout the network.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Interactive login by a service account to a sensitive server Medium (parent: Low)
  • Failed interactive login by a service account Informational (parent: Low)