Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A computer account was promoted to DC A computer account was promoted to a domain controller via a User Account Control (UAC) change.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A disabled user attempted to authenticate via SSO A disabled user attempted to authenticate via SSO.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	A disabled user attempted to log in A disabled user attempted to log in.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A disabled user attempted to log in to a VPN A disabled user attempted to log in suspiciously to a VPN.	Low	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Initial Access
Analytics BIOC	A machine certificate was issued with a mismatch A machine certificate was issued with a mismatch between the requester and the subject.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics	A new machine attempted Kerberos delegation A newly created machine attempted to perform a Kerberos delegation. This suspicious activity might indicate a Kerberos relay attack.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics BIOC	A possible risky login to Azure A risky sign-in attempt was observed in Azure.	Informational	Identity Analytics	AzureAD	Initial Access, Resource Development
Analytics BIOC	A process queried the ADFS database decryption key via LDAP A process queried the ADFS database decryption key (DKM key) via LDAP.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A Successful login from TOR A successful login from a TOR exit node.	High	Identity Analytics	XDR Agent	Initial Access, Command and Control
Analytics BIOC	A successful SSO sign-in from TOR A successful sign-in from a TOR exit node.	High	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access, Command and Control
Analytics BIOC	A Successful VPN connection from TOR A successful VPN connection from a TOR exit node.	High	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Initial Access, Command and Control
Analytics BIOC	A suspicious process queried AD CS objects via LDAP A suspicious process queried AD CS objects via LDAP.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	A user account was modified to password never expires A user account was modified to password never expires.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access
Analytics	A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics BIOC	A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation, Credential Access
Analytics BIOC	A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics BIOC	A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics BIOC	A user created a pfx file for the first time A user created a pfx file for the first time.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics	A user established an SMB connection to multiple hosts A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics	A user executed multiple LDAP enumeration queries A user executed multiple LDAP enumeration queries.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne	Defense Evasion
Analytics BIOC	A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Defense Evasion
Analytics BIOC	A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.	Informational	Identity Analytics	XDR Agent	Credential Access, Resource Development
Analytics	A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Persistence, Privilege Escalation, Credential Access
Analytics BIOC	A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics	A user received multiple weakly encrypted service tickets A user received multiple weakly encrypted service tickets. This is typically a sign of a Kerberoasting attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	A user rejected an SSO request from an unusual country A user rejected an SSO authentication request from an abnormal country.	Low	Identity Analytics	Okta, OneLogin	Credential Access, Resource Development
Analytics	A user requested multiple service tickets A user requested multiple service tickets. This is typically a sign of a Kerberoasting attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	A user sent multiple TGT requests to irregular service A user sent multiple TGT requests to services other than KRBTGT and KADMIN. This is typically a sign of a Kerberoasting attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A user was added to a Windows security group A user was added to a Windows security group.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics	Abnormal File Activity in SCCMContentLib Shared Folder by user A user generated suspicious file activity within the SCCMContentLib shared folder, which is considered a high-value target for attackers.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Privilege Escalation
Analytics BIOC	Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.	Informational	Identity Analytics	XDR Agent	Lateral Movement, Privilege Escalation
Analytics	Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.	Low	Identity Analytics	XDR Agent	Initial Access, Credential Access
Analytics BIOC	An inactive user attempted to authenticate A user with no activity in the past 30 days with the target, attempted to authenticate via universal authentication.	Informational	Identity Analytics		Initial Access
Analytics BIOC	Authentication attempt by a honey user An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	AzureAD, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	Azure device code authentication flow used An Azure AD login was performed with device code flow.	Informational	Identity Analytics	Azure Audit Log	Defense Evasion, Persistence
Analytics	Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Deletion of AD CS certificate database entries A user has deleted rows from the certificate database of an AD CS server.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Discovery of accounts with pre-authentication disabled via LDAP A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics	Excessive user account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	First connection from a country in organization A user connected to an SSO service from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics BIOC	First SSO access from ASN for user A user successfully authenticated via SSO with a new ASN.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	First SSO access from ASN in organization An SSO authentication was made with a new ASN.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	First SSO Resource Access in the Organization A resource was accessed for the first time via SSO.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access, Discovery
Analytics BIOC	First VPN access attempt from a country in organization A user attempted to connect from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics BIOC	First VPN access from ASN for user A user logged in to a VPN with a new ASN.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Initial Access
Analytics BIOC	First VPN access from ASN in organization A VPN connection was attempted from a new ASN.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Initial Access
Analytics	Impossible traveler - SSO User connected from several remote countries, at least one of which is not commonly used in the organization, within a short period of time. This may indicate the account is compromised.	Low	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	Impossible traveler - VPN A user connected to a VPN service from multiple remote countries in a short period of time, which should normally be impossible. This may indicate the account is compromised.	Low	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics	Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Initial Access
Analytics	Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.	Low	Identity Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Interactive login by a machine account A machine account performed an interactive or remote interactive login.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login by a service account A service account performed an interactive or remote interactive login.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics	Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Discovery
Analytics BIOC	Key credential attribute modification A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	LDAP AD CS Enumeration via Attack Tool A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	Linux local user account creation A user executed a process associated with user account creation.	Informational	Identity Analytics	XDR Agent	Persistence
Analytics	Local group enumeration A user performed an enumeration on local groups to retrieve their details.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Local user account creation A user was observed creating a rare local user account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Local user account creation by a machine account A machine account was observed creating a rare local user account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.	Informational	Identity Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Machine account was added to a domain admins group A machine account was added to a domain admins group.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics BIOC	Masquerading as a default local account A user created a new local account with the name of a default local account, such as Guest and DefaultAccount. An attacker may create a user with these known names to evade detection.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Member added to a Windows local security group A member was added to a Windows local security group.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics	Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.	Informational	Identity Analytics	XDR Agent	Credential Access, Privilege Escalation
Analytics BIOC	Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
Analytics	Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.	Informational	Identity Analytics	Okta	Credential Access, Resource Development
Analytics	Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.	Low	Identity Analytics	XDR Agent	Execution
Analytics	Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Execution
Analytics	Multiple suspicious user accounts were created A user was observed creating multiple rare user accounts.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics	Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Multiple user accounts were deleted A user deleted multiple user accounts.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Impact
Analytics	Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics	NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.	Informational	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.	Low	Identity Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs	Initial Access
Analytics BIOC	Penetration testing tool activity attempt A SaaS API was invoked by a penetration testing tool.	Informational	Identity Analytics	Office 365 Audit	Execution
Analytics BIOC	PKINIT TGT authentication request A Kerberos TGT was requested using PKINIT. This may indicate an attack on Active Directory Certificate Services (AD CS), such as shadow credential exploitation or certificate-based authentication abuse.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Privilege Escalation
Analytics	Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.	Medium	Identity Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Possible authentication coercion An unusual Remote Procedure Call (RPC) was made to potentially cause authentication coercion.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.	Informational	Identity Analytics		Credential Access, Resource Development
Analytics	Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics	Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Possible GPO Enumeration A possible GPO enumeration via LDAP was performed. Such enumeration may be used during attacks against the organization.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	Possible Impossible Travel Pattern - SSO A user logged in from several countries in a short period, including at least one location that is rare for the user or organization. This suspicious activity may be a sign of credential theft.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access, Resource Development
Analytics	Possible Kerberoasting attack A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.	Medium	Identity Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Possible Kerberos User Enumeration Multiple Kerberos TGT requests with KDC_ERR_C_PRINCIPAL_UNKNOWN errors were generated on different users in the last 10 minutes which may indicate Kerberos user enumeration.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery

Analytics BIOC

A computer account was promoted to DC A computer account was promoted to a domain controller via a User Account Control (UAC) change.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A disabled user attempted to authenticate via SSO A disabled user attempted to authenticate via SSO.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

A disabled user attempted to log in A disabled user attempted to log in.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A disabled user attempted to log in to a VPN A disabled user attempted to log in suspiciously to a VPN.

Low

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Initial Access

Analytics BIOC

A machine certificate was issued with a mismatch A machine certificate was issued with a mismatch between the requester and the subject.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics

A new machine attempted Kerberos delegation A newly created machine attempted to perform a Kerberos delegation. This suspicious activity might indicate a Kerberos relay attack.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics BIOC

A possible risky login to Azure A risky sign-in attempt was observed in Azure.

Informational

Identity Analytics

AzureAD

Initial Access, Resource Development

Analytics BIOC

A process queried the ADFS database decryption key via LDAP A process queried the ADFS database decryption key (DKM key) via LDAP.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A Successful login from TOR A successful login from a TOR exit node.

High

Identity Analytics

XDR Agent

Initial Access, Command and Control

Analytics BIOC

A successful SSO sign-in from TOR A successful sign-in from a TOR exit node.

High

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access, Command and Control

Analytics BIOC

A Successful VPN connection from TOR A successful VPN connection from a TOR exit node.

High

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Initial Access, Command and Control

Analytics BIOC

A suspicious process queried AD CS objects via LDAP A suspicious process queried AD CS objects via LDAP.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

A user account was modified to password never expires A user account was modified to password never expires.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access

Analytics

A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics BIOC

A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation, Credential Access

Analytics BIOC

A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics BIOC

A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics BIOC

A user created a pfx file for the first time A user created a pfx file for the first time.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics

A user established an SMB connection to multiple hosts A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics

A user executed multiple LDAP enumeration queries A user executed multiple LDAP enumeration queries.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne

Defense Evasion

Analytics BIOC

A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Defense Evasion

Analytics BIOC

A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.

Informational

Identity Analytics

XDR Agent

Credential Access, Resource Development

Analytics

A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Persistence, Privilege Escalation, Credential Access

Analytics BIOC

A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics

A user received multiple weakly encrypted service tickets A user received multiple weakly encrypted service tickets. This is typically a sign of a Kerberoasting attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

A user rejected an SSO request from an unusual country A user rejected an SSO authentication request from an abnormal country.

Low

Identity Analytics

Okta, OneLogin

Credential Access, Resource Development

Analytics

A user requested multiple service tickets A user requested multiple service tickets. This is typically a sign of a Kerberoasting attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

A user sent multiple TGT requests to irregular service A user sent multiple TGT requests to services other than KRBTGT and KADMIN. This is typically a sign of a Kerberoasting attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A user was added to a Windows security group A user was added to a Windows security group.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics

Abnormal File Activity in SCCMContentLib Shared Folder by user A user generated suspicious file activity within the SCCMContentLib shared folder, which is considered a high-value target for attackers.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Privilege Escalation

Analytics BIOC

Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.

Informational

Identity Analytics

XDR Agent

Lateral Movement, Privilege Escalation

Analytics

Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.

Low

Identity Analytics

XDR Agent

Initial Access, Credential Access

Analytics BIOC

An inactive user attempted to authenticate A user with no activity in the past 30 days with the target, attempted to authenticate via universal authentication.

Informational

Identity Analytics

Initial Access

Analytics BIOC

Authentication attempt by a honey user An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

AzureAD, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

Azure device code authentication flow used An Azure AD login was performed with device code flow.

Informational

Identity Analytics

Azure Audit Log

Defense Evasion, Persistence

Analytics

Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Deletion of AD CS certificate database entries A user has deleted rows from the certificate database of an AD CS server.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Discovery of accounts with pre-authentication disabled via LDAP A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics

Excessive user account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

First connection from a country in organization A user connected to an SSO service from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics BIOC

First SSO access from ASN for user A user successfully authenticated via SSO with a new ASN.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

First SSO access from ASN in organization An SSO authentication was made with a new ASN.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

First SSO Resource Access in the Organization A resource was accessed for the first time via SSO.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access, Discovery

Analytics BIOC

First VPN access attempt from a country in organization A user attempted to connect from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics BIOC

First VPN access from ASN for user A user logged in to a VPN with a new ASN.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Initial Access

Analytics BIOC

First VPN access from ASN in organization A VPN connection was attempted from a new ASN.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Initial Access

Analytics

Impossible traveler - SSO User connected from several remote countries, at least one of which is not commonly used in the organization, within a short period of time. This may indicate the account is compromised.

Low

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

Impossible traveler - VPN A user connected to a VPN service from multiple remote countries in a short period of time, which should normally be impossible. This may indicate the account is compromised.

Low

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics

Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Initial Access

Analytics

Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.

Low

Identity Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Interactive login by a machine account A machine account performed an interactive or remote interactive login.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login by a service account A service account performed an interactive or remote interactive login.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics

Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Discovery

Analytics BIOC

Key credential attribute modification A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

LDAP AD CS Enumeration via Attack Tool A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

Linux local user account creation A user executed a process associated with user account creation.

Informational

Identity Analytics

XDR Agent

Persistence

Analytics

Local group enumeration A user performed an enumeration on local groups to retrieve their details.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Local user account creation A user was observed creating a rare local user account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Local user account creation by a machine account A machine account was observed creating a rare local user account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.

Informational

Identity Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Machine account was added to a domain admins group A machine account was added to a domain admins group.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics BIOC

Masquerading as a default local account A user created a new local account with the name of a default local account, such as Guest and DefaultAccount. An attacker may create a user with these known names to evade detection.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Member added to a Windows local security group A member was added to a Windows local security group.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics

Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.

Informational

Identity Analytics

XDR Agent

Credential Access, Privilege Escalation

Analytics BIOC

Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Defense Evasion

Analytics

Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.

Informational

Identity Analytics

Okta

Credential Access, Resource Development

Analytics

Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.

Low

Identity Analytics

XDR Agent

Execution

Analytics

Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Execution

Analytics

Multiple suspicious user accounts were created A user was observed creating multiple rare user accounts.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics

Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Multiple user accounts were deleted A user deleted multiple user accounts.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Impact

Analytics

Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics

NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.

Informational

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.

Low

Identity Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs

Initial Access

Analytics BIOC

Penetration testing tool activity attempt A SaaS API was invoked by a penetration testing tool.

Informational

Identity Analytics

Office 365 Audit

Execution

Analytics BIOC

PKINIT TGT authentication request A Kerberos TGT was requested using PKINIT. This may indicate an attack on Active Directory Certificate Services (AD CS), such as shadow credential exploitation or certificate-based authentication abuse.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Privilege Escalation

Analytics

Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.

Medium

Identity Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Possible authentication coercion An unusual Remote Procedure Call (RPC) was made to potentially cause authentication coercion.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.

Informational

Identity Analytics

Credential Access, Resource Development

Analytics

Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics

Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Possible GPO Enumeration A possible GPO enumeration via LDAP was performed. Such enumeration may be used during attacks against the organization.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

Possible Impossible Travel Pattern - SSO A user logged in from several countries in a short period, including at least one location that is rare for the user or organization. This suspicious activity may be a sign of credential theft.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access, Resource Development

Analytics

Possible Kerberoasting attack A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.

Medium

Identity Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Possible Kerberos User Enumeration Multiple Kerberos TGT requests with KDC_ERR_C_PRINCIPAL_UNKNOWN errors were generated on different users in the last 10 minutes which may indicate Kerberos user enumeration.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery