Analytics
Low
✕
Short-lived user account
A user was created and deleted within a short period of time.
- Module:
- Identity Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:
Evasion using a valid account.
Investigative actions:
Check the user who created the account and verify the activity. Confirm that the account creation was not accidental.
- Test period:
- 1 Hour
- Deduplication:
- 1 Hour
2 variations:
- Abnormal short-lived user account Low
- Short-lived hidden user account Medium (parent: Low)