Identity threats
Find changes in account behavior that may indicate stolen credentials or misuse of valid access.
Detecting misuse of valid accounts
A successful sign-in is only the beginning of the investigation. Connect identity records in a SIEM with the account’s later activity and history to understand whether the access fits its legitimate purpose.
Valid accounts
Stolen credentials can let an attacker sign in without an obvious failure. Unusual hours, hosts and destinations provide useful leads when compared with the account’s own history and relevant peers.
Lateral movement
Connecting sign-ins and activity across hosts in a SIEM helps reveal how an account moved through the environment. A shared timeline and MITRE ATT&CK mappings help the analyst follow the sequence.
Privileged accounts
An AI Detection risk score can help prioritize review of privileged accounts. The useful evidence is the activity behind the score and how it changed over time.
Service accounts
Service accounts often have a defined job and predictable access. An unfamiliar destination or interactive logon deserves review against that purpose and any approved change.
Active Directory
Remote SIEM collection can bring Active Directory and domain controller records together with LDAP, VPN and Microsoft 365 activity. The design identifies the required credentials and collection permissions, including WMI where it is the approved collection method.
Silent sources
Monitoring source health in a SIEM helps the team notice when identity records stop arriving. A missing expected event can then be investigated as a collection or operating issue.
By scenario
User signs in at 3 a.m. from a new host
Compare the time and host with the account’s history, approved work and subsequent actions.
Service account logs on interactively
Review the interactive session against the account’s assigned purpose and any authorized maintenance.
Same account active on two hosts at once
Correlate the sessions and their activity to establish whether the overlap is expected or needs investigation.
Administrator risk score rising for a week
Examine the events driving the trend before deciding whether to escalate the account.
Domain controller logs stop arriving
A SIEM silent-source alert directs the team to the collection gap and the period that needs review.
Questions
Does ARRTECH replace our identity provider?
The identity provider continues to issue identities and manage access. SIEM monitoring uses its activity records to investigate how those identities are used.
Do we need an agent on domain controllers?
No. Collection runs remotely from another server.
Who resets the password?
An authorized administrator or SOAR workflow performs the reset. The case should retain the reason, approval and outcome.
How quickly are findings reported?
SIEM correlation alerts and AI Detection findings have different processing schedules. Evaluate the full delay from source event to reviewable finding for the intended use.
Guide
What is a valid accounts attack?
An attack that uses legitimate credentials to sign in, persist and move through a network. MITRE ATT&CK tracks it as technique T1078.
What are the signs of a compromised account?
Sign-ins at unusual times or from unusual hosts, concurrent sessions and interactive logons by service accounts.
What is lateral movement?
An attacker moving from host to host inside a network, usually with credentials found on the way.
How ARRTECH takes care of identity threats
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
