User Logged in to Multiple Hosts
Hypothesis and description
Most users use only one or two machines during the normal course of business. User accounts that log in to multiple machines, especially over a short period of time, may be compromised. Remote logins among multiple machines may be an indicator of Lateral Movement.
Certain users will likely appear as being logged into several machines and may need to be "whitelisted." Such users would include network admins or user names that are common to many hosts.
### Output Description
User Name, Machines logged into, the earliest and latest times in which users were logged into the host, the type of logon, and logon ID.
- Platforms
- Windows, Linux, macOS
- Domain
- Host
- Subtypes
- Login
- Submitted
- 2013-02-27
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1078 Valid AccountsT1078.002, T1078.003 | Lateral Movement | Moderate |
1 technique, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-LAMLocal Account Monitoring1 shared
- D3-DAMDomain Account Monitoring1 shared
- D3-ALAccount Locking1 shared
- D3-AAAgent Authentication1 shared
- D3-RUAARestore User Account Access1 shared
- D3-ULAUnlock Account1 shared
- D3-UAPUser Account Permissions1 shared
- D3-CDPChange Default Password1 shared
- D3-AMAccess Modeling1 shared