AN1543
Analytic 1543
Windows
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
WinEventLog:Security
EventCode=4624
WinEventLog:Security
EventCode=4776, 4625
WinEventLog:Sysmon
EventCode=1
[LogonType]
Flag unexpected logon types (e.g., Type 10 for remote interactive logins) for sensitive accounts.
[TimeWindow]
Define acceptable hours for interactive logon activity (e.g., 9AM-6PM local).
[GeoIPMismatch]
Trigger on location anomalies based on prior user behavior or policy.
AN1544
Analytic 1544
Linux
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
auditd:SYSCALL
execve
NSM:Connections
sshd or PAM logins
[UserContext]
Identify logins to root or sudoers not aligned with normal usage profiles.
[HostDensityThreshold]
Number of unique systems a user authenticates to in a time window.
[LoginMethod]
Trigger on rarely used access methods such as password instead of SSH key.
AN1545
Analytic 1545
macOS
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
macos:unifiedlog
loginwindow, sshd
macos:unifiedlog
exec logs
[LoginOrigin]
Login sourced from unexpected remote addresses.
[ProcessTreeDepth]
Track execution depth or anomalous chains post-login.
AN1546
Analytic 1546
Identity Provider
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.
saas:okta
Sign-in logs / audit events
[MFAFailureCount]
Threshold of failed MFA attempts before alerting.
[RiskScoreThreshold]
Custom threshold based on calculated identity risk.
[IPGeoVelocity]
Detect impossible travel (logins from two distant geolocations within short time).
AN1547
Analytic 1547
Containers
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.
kubernetes:audit
authentication.k8s.io
[ServiceAccountScope]
Validate access from expected namespaces only.
[ClusterIPWhitelist]
Permit kubeconfig usage from a limited set of IPs.