1200KM / detection
Detection workspace for T1078 Valid Accounts: 55 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.
MATCH(successful_login) AND source_country IN blocked_countries -> ALERT; COUNT(failed_login BY account, 10m) >= threshold FOLLOWED_BY successful_login WITHIN 10m -> ALERTComparison unit: identity.
Expected behavior: each identity and peer group uses a stable set of locations, devices, applications, times, and authentication methods.
Deviation: a rare combination or abrupt shift across those attributes.
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.