ContraForce - Machine credential activity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


Identifies service-account and machine-credential lifecycle activity in the ContraForce workspace: service accounts created or deleted, credentials created, regenerated or revoked, and API client secret regenerations. Machine credentials grant standing programmatic access, so unexpected lifecycle events can indicate persistence being established or an attempt to rotate credentials out from under their legitimate owner.

Attribute Value
Type Analytic Rule
Solution ContraForce
ID 8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52
Severity Medium
Status Available
Kind Scheduled
Tactics Persistence, CredentialAccess
Techniques T1098, T1136
Required Connectors ContraForceEvents
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
ContraForceEvents_CL ? ✓ ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to ContraForce