A user logged on to multiple workstations via Schannel

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent
Detection Modules	Identity Analytics
ATT&CK Tactic	Persistence (TA0003) Privilege Escalation (TA0004) Credential Access (TA0006)
ATT&CK Technique	Account Manipulation (T1098) Valid Accounts (T1078) Steal or Forge Authentication Certificates (T1649)
Severity	Informational

A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.

Elevate permissions and establish persistence.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A rare user authentication with a certificate via Schannel was observed. This may be indicative of a compromised account.

Elevate permissions and establish persistence.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

An abnormal authentication with a certificate via Schannel was observed. This may be indicative of a compromised account.

Elevate permissions and establish persistence.