Situational AwarenessCAR-2013-02-008

Simultaneous Logins on a Host

Hypothesis and description

Multiple users logged into a single machine at the same time, or even within the same hour, do not typically occur in networks we have observed.

Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista.

Logon types 2, 3, 9 and 10 are of interest. For more details see the Logon Types table on Microsoft's Audit Logon Events) page.

Platforms: Windows, Linux, macOS
Domain: Host
Subtypes: Login
Submitted: 2013-02-18
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1078 Valid AccountsT1078.002, T1078.003	Initial Access	Low

1 technique, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1078Valid Accounts
.002 Domain Accounts .003 Local Accounts

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-ANET Authentication Event Thresholding

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

users_list = search UserSession:Login
users_grouped = group users_list by hostname
users_grouped = from users_grouped select min(time) as earliest_time, max(time) as latest_time count(user) as user_count
multiple_logins = filter users_grouped where (latest_time - earliest_time <= 1 hour and user_count > 1)
output multiple_logins

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2013-02-008 on car.mitre.org