Analytics BIOC
Informational
✕
Login by a dormant user
A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.
- Module:
- Identity Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:
Use a compromised user account that has not been used for a long time and is therefore less likely to be noticed.
Investigative actions:
Confirm that the activity is benign (e.g. the user returned from a long leave of absence). See whether there are other abnormal actions done by the user (e.g. files\commands\other logins). Check whether you have issues with your Cloud Identity Engine failing to sync data from Active Directory.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Cached interactive login by a dormant user Informational