A rare local administrator login

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent
Detection Modules	Identity Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

The attacker attempts to change sensitive settings on the host.

Check for any other suspicious activity related to the host and the user involved in the alert.

A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

The attacker attempts to change sensitive settings on the host.

Check for any other suspicious activity related to the host and the user involved in the alert.