Analytics BIOC
Informational
✕
Rare machine account creation
A user was observed creating a machine account for the first time.
- Module:
- Identity Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Create Account (T1136)
Attacker's goals:
Persistence using a valid account.
Investigative actions:
Verify the activity of the user who created the account. Follow actions performed by the new machine account.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day