Analytics BIOC
Low
✕
SSO authentication by a machine account
A machine account successfully authenticated via SSO.
- Module:
- Identity Analytics
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:
Use an account that has access to resources to move laterally in the network and access privileged resources.
Investigative actions:
Check whether the account has done any administrative actions it should not usually do. Look for more logins and authentications by the account throughout the network.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- SSO authentication by a machine account from a suspicious IP Medium (parent: Low)