Techniques › T1078
T1078 Valid Accounts
stealth · persistence · privilege escalation · initial access — Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
56
Sigma rules tagged attack.t1078
46
KEV CVEs mapped here
<p>Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.</p><p>In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.</p><p>The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-24016 | Wazuh Wazuh Server | exploitation technique | Mapped | 2025-06-10 |
| CVE-2023-39780 | ASUS RT-AX55 Routers | exploitation technique | Mapped | 2025-06-02 |
| CVE-2021-20035 | SonicWall SMA100 Appliances | exploitation technique | Mapped | 2025-04-16 |
| CVE-2025-31161 | CrushFTP CrushFTP | exploitation technique | Mapped | 2025-04-07 |
| CVE-2024-57968 | Advantive VeraCore | exploitation technique | Mapped | 2025-03-10 |
| CVE-2023-20118 | Cisco Small Business RV Series Routers | exploitation technique | Mapped | 2025-03-03 |
| CVE-2024-55591 | Fortinet FortiOS and FortiProxy | primary impact | Mapped | 2025-01-14 |
| CVE-2024-37085 | VMware ESXi | exploitation technique | Mapped | 2024-07-30 |
| CVE-2022-22948 | VMware vCenter Server | exploitation technique | Mapped | 2024-07-17 |
| CVE-2024-20399 | Cisco NX-OS | exploitation technique | Mapped | 2024-07-02 |
| CVE-2024-20359 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | exploitation technique | Mapped | 2024-04-24 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons | primary impact | Mapped | 2024-01-31 |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure | primary impact | Mapped | 2024-01-10 |
| CVE-2023-27524 | Apache Superset | primary impact | Mapped | 2024-01-08 |
| CVE-2023-20273 | Cisco Cisco IOS XE Web UI | exploitation technique | Mapped | 2023-10-23 |
| CVE-2023-20109 | Cisco IOS and IOS XE | exploitation technique | Mapped | 2023-10-10 |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | secondary impact | Mapped | 2023-10-05 |
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service | exploitation technique | Mapped | 2023-10-04 |
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security | exploitation technique | Mapped | 2023-09-21 |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense | primary impact | Mapped | 2023-09-13 |
| CVE-2023-20867 | VMware Tools | exploitation technique | Mapped | 2023-06-23 |
| CVE-2023-28252 | Microsoft Windows | exploitation technique | Mapped | 2023-04-11 |
| CVE-2023-23397 | Microsoft Office | secondary impact | Mapped | 2023-03-14 |
| CVE-2023-22952 | SugarCRM Multiple Products | secondary impact | Stale | 2023-02-02 |
| CVE-2023-21674 | Microsoft Windows | exploitation technique | Mapped | 2023-01-10 |
| CVE-2022-26500 | Veeam Backup & Replication | exploitation technique | Mapped | 2022-12-13 |
| CVE-2022-41073 | Microsoft Windows | exploitation technique | Mapped | 2022-11-08 |
| CVE-2022-41125 | Microsoft Windows | exploitation technique | Mapped | 2022-11-08 |
| CVE-2022-41082 | Microsoft Exchange Server | exploitation technique | Mapped | 2022-09-30 |
| CVE-2022-37969 | Microsoft Windows | exploitation technique | Mapped | 2022-09-14 |
| CVE-2022-22047 | Microsoft Windows | exploitation technique | Mapped | 2022-07-12 |
| CVE-2022-26904 | Microsoft Windows | exploitation technique | Mapped | 2022-04-25 |
| CVE-2022-21919 | Microsoft Windows | exploitation technique | Mapped | 2022-04-25 |
| CVE-2022-22718 | Microsoft Windows | exploitation technique | Mapped | 2022-04-19 |
| CVE-2022-24521 | Microsoft Windows | exploitation technique | Mapped | 2022-04-13 |
| CVE-2022-1040 | Sophos Firewall | secondary impact | Mapped | 2022-03-31 |
| CVE-2022-21999 | Microsoft Windows | exploitation technique | Mapped | 2022-03-25 |
| CVE-2022-20701 | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | exploitation technique | Mapped | 2022-03-03 |
| CVE-2021-41379 | Microsoft Windows | exploitation technique | Mapped | 2022-03-03 |
| CVE-2022-23131 | Zabbix Frontend | secondary impact | Mapped | 2022-02-22 |
| CVE-2021-36934 | Microsoft Windows | exploitation technique | Mapped | 2022-02-10 |
| CVE-2021-42321 | Microsoft Exchange | exploitation technique | Mapped | 2021-11-17 |
| CVE-2019-13608 | Citrix StoreFront Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-22894 | Ivanti Pulse Connect Secure | exploitation technique | Mapped | 2021-11-03 |
| CVE-2021-22899 | Ivanti Pulse Connect Secure | exploitation technique | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0560 Detection of Valid Account Abuse Across Platforms v1.0
AN1543 WindowsDetection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.Tunable:
LogonTypeTimeWindowGeoIPMismatchAN1544 LinuxDetection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.Tunable:UserContextHostDensityThresholdLoginMethodAN1545 macOSDetection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.Tunable:LoginOriginProcessTreeDepthAN1546 Identity ProviderDetection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.Tunable:MFAFailureCountRiskScoreThresholdIPGeoVelocityAN1547 ContainersDetection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.Tunable:ServiceAccountScopeClusterIPWhitelist
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1078
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 128faeef-79dd-44ca-b43c-a9e236a60f49
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Author: Josh Nickels, Marius Rothenbücher
· 2025-01-08 · logsource: product=m365 service=audit · 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 1a41023f-1e70-4026-921a-4d9341a9038e
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 248649b7-d64f-46f0-9fb2-a52774166fb5
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Austin Songer
· 2021-09-06 (modified 2022-06-08) · logsource: product=azure service=auditlogs · 352a54e1-74ba-4929-9d47-8193d67aba1e
Identifies when an user or application modified the federation settings on the domain.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Author: elhoim
· 2022-09-09 (modified 2023-01-04) · logsource: product=windows service=security · 39698b3f-da92-4bc6-bfb5-645a98386e45
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Author: Florian Roth (Nextron Systems)
· 2017-03-17 (modified 2023-12-15) · logsource: product=windows service=security · 3ff152b2-1388-4984-9cd9-a323323fdadf
Detects interactive console logons to Server Systems
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-09) · logsource: product=azure service=auditlogs · 4ad97bf5-a514-41a4-abd3-4f3455ad4865
Detects guest users being invited to tenant by non-approved inviters
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 55695bc0-c8cf-461f-a379-2535f563c854
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Harjot Singh, '@cyb3rjy0t'
· 2023-01-10 (modified 2025-07-02) · logsource: product=azure service=signinlogs · 572b12d4-9062-11ed-a1eb-0242ac120002
Detects risky authentication from a non AD registered device without MFA being required.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 58af08eb-f9e1-43c8-9805-3ad9b0482bd8
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 645fd80d-6c07-435b-9e06-7bc1b5656cba
Identifies when the same privilege role has multiple activations by the same user.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
· 2022-08-11 (modified 2022-08-18) · logsource: product=azure service=auditlogs · 6f583da0-3a90-4566-a4ed-83c09fe18bbf
Detects when an account was created and deleted in a short period of time.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 7bbc309f-e2b1-4eb1-8369-131a367d67d3
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Author: Sohan G (D4rkCiph3r)
· 2023-08-22 · logsource: product=macos category=process_creation · 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
Detects attempts to enable the root account via "dsenableroot"
Author: Austin Songer @austinsonger
· 2021-11-26 (modified 2022-12-18) · logsource: product=azure service=signinlogs · 8366030e-7216-476b-9927-271d79f13cf3
Detects when there is a interruption in the authentication process.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 8c6ec464-4ae4-43ac-936a-291da66ed13d
Identifies when a user has been assigned a privilege role and are not using that role.
Author: Ivan Saakov
· 2024-12-19 · logsource: product=aws service=cloudtrail · 92f84194-8d9a-4ee0-8699-c30bfac59780
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton
· 2020-10-05 (modified 2022-08-03) · logsource: product=windows service=security · 941e5c45-cda7-4864-8cea-bbb7458d194a
Detects suspicious processes logging on with explicit credentials
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 944f6adb-7a99-4c69-80c1-b712579e93e6
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 94a66f46-5b64-46ce-80b2-75dcbe627cc0
Identifies when a privilege role can be activated without performing mfa.
Author: Florian Roth (Nextron Systems)
· 2017-02-19 (modified 2025-10-17) · logsource: product=windows service=security · 9eb99343-d336-4020-a3cd-67f3819e68ee
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · adf9f4d2-559e-4f5c-95be-c28dff0b1476
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-09 · logsource: product=azure service=auditlogs · aeaef14c-e5bf-4690-a9c8-835caad458bd
Detects when PIM alerts are set to disabled.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · b1bc08d1-8224-4758-a0e6-fbcfc98c73bb
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · b2572bf9-e20a-4594-b528-40bde666525a
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · be4d9c86-d702-4030-b52e-c7859110e5e8
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · c191e2fa-f9d6-4ccf-82af-4f2aba08359f
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'
· 2022-08-11 (modified 2023-12-15) · logsource: product=azure service=auditlogs · c98184ba-4a27-4e10-b7b7-da48e71f4d25
Detects accounts that are created or deleted by non-approved users.
Author: Austin Songer @austinsonger
· 2021-11-26 (modified 2022-12-25) · logsource: product=azure service=auditlogs · ca9bf243-465e-494a-9e54-bf9fc239057d
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-11 (modified 2023-12-15) · logsource: product=azure service=signinlogs · cf1e5687-84e1-41af-97a9-158094efef53
Detects failed sign-in due to user not meeting expected controls for adminitrators
Author: Tim Shelton (HAWK.IO)
· 2021-12-09 (modified 2023-02-21) · logsource: product=windows category=process_creation · d4498716-1d52-438f-8084-4a603157d131
Detects a when net.exe is called with a password in the command line
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · d7329412-13bd-44ba-a072-3387f804a106
Detects attempts to enable the guest account using the sysadminctl utility
Author: Austin Songer @austinsonger
· 2020-07-06 (modified 2021-11-27) · logsource: product=m365 service=threat_management · d7eab125-5f94-43df-8710-795b80fa1189
Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
Author: frack113
· 2022-02-21 · logsource: product=windows category=ps_module · e3818659-5016-4811-a73c-dde4679169d2
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
You can use it to reset the password of the local computer.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · e402c26a-267a-45bd-9615-bd9ceda6da85
Identifies when an account hasn't signed in during the past n number of days.
Author: Tom Kluter
· 2026-04-28 · logsource: product=gcp service=google_workspace.login · eafe6f2b-cfec-4612-aec2-49563c33a087
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Author: Raphaël CALVET, @MetallicHack
· 2021-10-04 (modified 2026-04-30) · logsource: product=azure service=auditlogs · ebbeb024-5b1d-4e16-9c0c-917f86c708a7
User Added to an Administrator's Azure AD Role
Author: kelnage
· 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-08) · logsource: product=azure service=signinlogs · f272fb46-25f2-422c-b667-45837994980f
Detect when authentications to important application(s) only required single-factor authentication
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Author: NVISO
· 2020-05-06 (modified 2024-03-11) · logsource: product=windows service=security · f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.