Analytics BIOC
Informational
✕
Interactive login from a shared user account
A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.
- Module:
- Identity Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:
Gaining access to a shared account and multiple hosts and systems throughout the organization.
Investigative actions:
Ensure that the shared account is legitimate and has a justified role in the organization.
- Test period:
- N/A (single event)
- Deduplication:
- 30 Days