Analytics Story: Compromised User Account

Created: 2023-01-19 Last Updated: 2026-05-13 ID: 19669154-e9d1-4a01-b144-e6592a078092 Author: Mauricio Velazco, Bhavin Patel, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with Compromised User Account attacks.

Why it matters

Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic story groups detections that can help security operations teams identify the potential signs of Compromised User Accounts.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Detect Distributed Password Spray Attempts	Password Spraying	Hunting
PingID Multiple Failed MFA Requests For User	Valid Accounts, Brute Force, Multi-Factor Authentication Request Generation	TTP
Azure AD New MFA Method Registered For User	Multi-Factor Authentication	TTP
AWS High Number Of Failed Authentications From Ip	Password Spraying, Credential Stuffing	Anomaly
AWS Console Login Failed During MFA Challenge	Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
Detect Password Spray Attempts	Password Spraying	TTP
AWS Multiple Users Failing To Authenticate From Ip	Password Spraying, Credential Stuffing	Anomaly
Azure AD Service Principal Enumeration	Cloud Account, Cloud Service Discovery	TTP
Azure AD Successful Authentication From Different Ips	Password Guessing, Password Spraying	TTP
PingID New MFA Method Registered For User	Device Registration, Multi-Factor Authentication, Multi-Factor Authentication Request Generation	TTP
Azure AD AzureHound UserAgent Detected	Cloud Account, Cloud Service Discovery	TTP
Detect AWS Console Login by User from New Country	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
AWS Password Policy Changes	Password Policy Discovery	Hunting
AWS Successful Console Authentication From Multiple IPs	Unused/Unsupported Cloud Regions, Compromise Accounts	Anomaly
AWS Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
Detect AWS Console Login by User from New Region	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
Windows AD SPN Unicode Collision Injection	Downgrade Attack	TTP
Azure AD High Number Of Failed Authentications From Ip	Password Guessing, Password Spraying	TTP
O365 SharePoint Suspicious Search Behavior	Sharepoint, Unsecured Credentials	Anomaly
PingID Mismatch Auth Source and Verification Response	Device Registration, Multi-Factor Authentication, Multi-Factor Authentication Request Generation	TTP
Windows Remote Desktop Network Bruteforce Attempt	Password Guessing	Anomaly
Detect Password Spray Attack Behavior On User	Password Spraying	TTP
Windows AD Computer SPN Modified By User Account	Kerberoasting, Downgrade Attack	Anomaly
AWS High Number Of Failed Authentications For User	Password Policy Discovery	Anomaly
Detect AWS Console Login by User from New City	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
Azure AD High Number Of Failed Authentications For User	Password Guessing	TTP
Detect Password Spray Attack Behavior From Source	Password Spraying	TTP
PingID New MFA Method After Credential Reset	Device Registration, Multi-Factor Authentication, Multi-Factor Authentication Request Generation	TTP
ASL AWS Concurrent Sessions From Different Ips	Browser Session Hijacking	Anomaly
Azure AD Concurrent Sessions From Different Ips	Browser Session Hijacking	TTP
O365 Email Suspicious Search Behavior	Remote Email Collection, Unsecured Credentials	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Azure Active Directory Sign-in activity	Azure	`azure:monitor:aad`	`Azure AD`
PingID	Other	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Active Directory User registered security info	Azure	`azure:monitor:aad`	`Azure AD`
AWS CloudTrail ConsoleLogin	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Windows Event Log Security 4625	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Azure Active Directory MicrosoftGraphActivityLogs	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory NonInteractiveUserSignInLogs	Azure	`azure:monitor:aad`	`Azure AD`
AWS CloudTrail	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail GetAccountPasswordPolicy	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail DeleteAccountPasswordPolicy	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail UpdateAccountPasswordPolicy	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail DescribeEventAggregates	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Windows Event Log Security 5136	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Office 365 Universal Audit Log	Microsoft 365	`o365:management:activity`	`o365`
Cisco Secure Access Firewall	Network	`cisco:cloud_security:firewall`	`cisco_secure_access:firewall`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4624	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
ASL AWS CloudTrail	AWS	`aws:asl`	`aws_asl`

References

https://www.proofpoint.com/us/threat-reference/compromised-account

Source: GitHub | Version: 2