New Shared User Account

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Hours
Deduplication Period	30 Days
Required Data	XDR Agent
Detection Modules	Identity Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low

Description

A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Attacker's Goals

Gaining access to a shared account and multiple hosts and systems throughout the organization.

Investigative actions

Ensure that the shared account is legitimate and has a justified role in the organization.