Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies service-account and machine-credential lifecycle activity in the ContraForce workspace: service accounts created or deleted, credentials created, regenerated or revoked, and API client secret regenerations. Machine credentials grant standing programmatic access, so unexpected lifecycle events can indicate persistence being established or an attempt to rotate credentials out from under their legitimate owner.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | ContraForce |
| ID | 8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52 |
| Severity | Medium |
| Status | Available |
| Kind | Scheduled |
| Tactics | Persistence, CredentialAccess |
| Techniques | T1098, T1136 |
| Required Connectors | ContraForceEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
ContraForceEvents_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊