Analytics BIOC Low
✕

SSO authentication by a service account

A service account successfully authenticated via SSO.

Module:
Identity Analytics
Data source:
AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that has access to resources to move laterally in the network and access privileged resources.

Investigative actions:

Check whether the account has done any administrative actions it should not usually do. Look for more logins and authentications by the account throughout the network.

Test period:
N/A (single event)
Deduplication:
2 Days
3 variations:
  • Rare non-interactive SSO authentication by a service account Informational (parent: Low)
  • SSO authentication by a service account via a suspicious IP Low
  • First time SSO authentication by a service account Medium (parent: Low)