Analytics BIOC
Informational
✕
Local user account creation by a machine account
A machine account was observed creating a rare local user account.
- Module:
- Identity Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Valid Accounts: Local Accounts (T1078.003)
Attacker's goals:
Persistence using a valid account.
Investigative actions:
Check the machine that created the user account and verify its activity. Check if the machine account is supposed to create user accounts. Investigate whether the same account was created on different hosts as part of an installation process.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day