PRODAFT USTA - Compromised credential used in successful sign-in

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Correlates corporate credentials exposed in PRODAFT USTA Account Takeover Prevention tickets with successful Microsoft Entra ID sign-ins for the same user. A successful sign-in by an account whose credentials are known to be compromised is a strong signal of account takeover. Requires the Microsoft Entra ID (SigninLogs) connector. Username matching is best-effort (case-insensitive) because USTA may record either an email or a bare username.

Attribute Value
Type Analytic Rule
Solution PRODAFT USTA - Account Takeover Prevention
ID 5da571b5-54f6-42c2-8c3e-27edd987ceec
Severity High
Status Available
Kind Scheduled
Tactics CredentialAccess, InitialAccess
Techniques T1078, T1555
Required Connectors PRODAFTUstaATPCCPDefinition, AzureActiveDirectory
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
PRODAFTUstaCompromisedCredentials_CL ? ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to PRODAFT USTA - Account Takeover Prevention