Analytics Informational
✕

Short-lived Azure AD user account

An Azure AD user was created and deleted within a short period of time.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:
Identity Threat Detection (ITDR)
Data source:
AzureAD Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:

Evasion using a valid account.

Investigative actions:

Check the user who created the account and verify the activity. Confirm that the account creation was not accidental.

Test period:
1 Hour
Deduplication:
1 Day
1 variation:
  • Abnormal Short-lived Azure AD user account Low (parent: Informational)