1200KM / detection
Detection workspace for T1078 Valid Accounts: 55 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.
MATCH(successful_login) AND source_country IN blocked_countries -> ALERT; COUNT(failed_login BY account, 10m) >= threshold FOLLOWED_BY successful_login WITHIN 10m -> ALERTComparison unit: identity.
Expected behavior: each identity and peer group uses a stable set of locations, devices, applications, times, and authentication methods.
Deviation: a rare combination or abrupt shift across those attributes.
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.