Compromise Accounts `T1586`

Tactic: Resource Development

Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Authoring guide

These 41 rules share fields, values, and exclusions.

Fields filtered most (51 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`sourcetype`	30	`eq` 30	`aws:cloudtrail`, `azure:monitor:aad`, `gws:reports:login`, `aws:asl`, `o365:management:activity`
`aws::eventName`	12	`eq` 12	`consolelogin`, `deactivatemfadevice`, `deletevirtualmfadevice`, `getpassworddata`, `modifydbinstance`
`category`	9	`eq` 8, `ends_with` 1	`signinlogs`, `auditlogs`, `userriskevents`
`signature`	6	`eq` 6	`consolelogin`, `user.authentication.auth_via_mfa`, `user.session.start`
`event.name`	5	`eq` 5	`login_failure`, `login_success`
`properties.authenticationDetails{}.succeeded`	5	`eq` 5	`false`, `true`
`properties.status.errorCode`	5	`eq` 5	`50126`, `500121`
`additionalEventData.MFAUsed`	3	`eq` 3	`yes`, `no`
`aws::errorMessage`	3	`eq` 3	`failed authentication`
`isOutlier`	3	`eq` 3	`1`
`operationName`	3	`eq` 2, `contains` 1	`Add member to role in PIM completed`, `disable strong authentication`, `sign-in activity`
`ErrorNumber`	2	`eq` 2	`50126`
`Operation`	2	`eq` 2	`userloginfailed`
`Workload`	2	`eq` 2	`azureactivedirectory`
`action`	2	`eq` 2	`failure`, `success`

Top indicator values (92 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS Console Login Failed During MFA Challenge splunkAWS Credential Access Failed Login splunkAWS Credential Access GetPasswordData splunkAWS Credential Access RDS Password reset splunkAWS Multi-Factor Authentication Disabled splunkAWS Multiple Failed MFA Requests For User splunkAWS Successful Console Authentication From Multiple IPs splunkAWS Successful Single-Factor Authentication splunkAWS Unusual Number of Failed Authentications From Ip	9	59
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure Active Directory High Risk Sign-in splunkAzure AD Authentication Failed During MFA Challenge splunkAzure AD Multi-Factor Authentication Disabled splunkAzure AD Multi-Source Failed Authentications Spike splunkAzure AD Multiple Failed MFA Requests For User splunkAzure AD Multiple Users Failing To Authenticate From Ip splunkAzure AD Successful PowerShell Authentication splunkAzure AD Successful Single-Factor Authentication splunkAzure AD Unusual Number of Failed Authentications From Ip	9	47
`sourcetype`	`eq`	`gws:reports:login` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User splunkGCP Multiple Users Failing To Authenticate From Ip splunkGCP Successful Single-Factor Authentication splunkGCP Unusual Number of Failed Authentications From Ip	5	5
`sourcetype`	`eq`	`aws:asl` splunkASL AWS Credential Access GetPasswordData splunkASL AWS Credential Access RDS Password reset splunkASL AWS Multi-Factor Authentication Disabled	3	27
`aws::eventName`	`eq`	`consolelogin` splunkAWS Console Login Failed During MFA Challenge splunkAWS Credential Access Failed Login splunkAWS Multiple Failed MFA Requests For User splunkAWS Successful Console Authentication From Multiple IPs splunkAWS Successful Single-Factor Authentication splunkAWS Unusual Number of Failed Authentications From Ip	6	19
`aws::eventName`	`eq`	`deactivatemfadevice` splunkASL AWS Multi-Factor Authentication Disabled splunkAWS Multi-Factor Authentication Disabled	2	2
`aws::eventName`	`eq`	`deletevirtualmfadevice` splunkASL AWS Multi-Factor Authentication Disabled splunkAWS Multi-Factor Authentication Disabled	2	2
`aws::eventName`	`eq`	`getpassworddata` splunkASL AWS Credential Access GetPasswordData splunkAWS Credential Access GetPasswordData	2	3
`aws::eventName`	`eq`	`modifydbinstance` splunkASL AWS Credential Access RDS Password reset splunkAWS Credential Access RDS Password reset	2	3
`category`	`eq`	`signinlogs` splunkAzure AD Authentication Failed During MFA Challenge splunkAzure AD Multiple Failed MFA Requests For User splunkAzure AD Multiple Users Failing To Authenticate From Ip splunkAzure AD Successful PowerShell Authentication splunkAzure AD Successful Single-Factor Authentication splunkAzure AD Unusual Number of Failed Authentications From Ip	6	12
`event.name`	`eq`	`login_failure` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User splunkGCP Multiple Users Failing To Authenticate From Ip splunkGCP Unusual Number of Failed Authentications From Ip	4	4
`signature`	`eq`	`consolelogin` splunkDetect AWS Console Login by New User splunkDetect AWS Console Login by User from New City splunkDetect AWS Console Login by User from New Country splunkDetect AWS Console Login by User from New Region	4	4
`aws::errorMessage`	`eq`	`failed authentication` splunkAWS Console Login Failed During MFA Challenge splunkAWS Credential Access Failed Login splunkAWS Multiple Failed MFA Requests For User	3	4
`isOutlier`	`eq`	`1` splunkAWS Unusual Number of Failed Authentications From Ip splunkAzure AD Unusual Number of Failed Authentications From Ip splunkGCP Unusual Number of Failed Authentications From Ip	3	33
`properties.authenticationDetails{}.succeeded`	`eq`	`false` splunkAzure AD Multi-Source Failed Authentications Spike splunkAzure AD Multiple Users Failing To Authenticate From Ip splunkAzure AD Unusual Number of Failed Authentications From Ip	3	5
`properties.status.errorCode`	`eq`	`50126` splunkAzure AD Multi-Source Failed Authentications Spike splunkAzure AD Multiple Users Failing To Authenticate From Ip splunkAzure AD Unusual Number of Failed Authentications From Ip	3	5
`ErrorNumber`	`eq`	`50126` splunkO365 Multi-Source Failed Authentications Spike splunkO365 Multiple Users Failing To Authenticate From Ip	2	2
`Operation`	`eq`	`userloginfailed` splunkO365 Multi-Source Failed Authentications Spike splunkO365 Multiple Users Failing To Authenticate From Ip	2	7
`Workload`	`eq`	`azureactivedirectory` splunkO365 Multi-Source Failed Authentications Spike splunkO365 Multiple Users Failing To Authenticate From Ip	2	30
`additionalEventData.MFAUsed`	`eq`	`yes` splunkAWS Console Login Failed During MFA Challenge splunkAWS Multiple Failed MFA Requests For User	2	3
`event.parameters{}.multiValue{}`	`in`	`backup_code` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`google_authenticator` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`google_prompt` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`idv_any_phone` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`idv_preregistered_phone` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`internal_two_factor` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`knowledge_employee_id` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`knowledge_preregistered_email` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`knowledge_preregistered_phone` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2
`event.parameters{}.multiValue{}`	`in`	`login_location` splunkGCP Authentication Failed During MFA Challenge splunkGCP Multiple Failed MFA Requests For User	2	2

Exclusions (14 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`auth_msg`	`eq`	`mfa successfully completed` splunkAzure AD Authentication Failed During MFA Challenge	1
`event.parameters{}.multiValue{}`	`in`	`backup_code` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`google_authenticator` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`google_prompt` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`idv_any_phone` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`idv_preregistered_phone` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`internal_two_factor` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`knowledge_employee_id` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`knowledge_preregistered_email` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`knowledge_preregistered_phone` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`login_location` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`offline_otp` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`security_key` splunkGCP Successful Single-Factor Authentication	1
`event.parameters{}.multiValue{}`	`in`	`security_key_otp` splunkGCP Successful Single-Factor Authentication	1

Compromise Accounts `T1586`

Authoring guide

Fields filtered most (51 distinct)

Top indicator values (92 distinct)

Exclusions (14 distinct)

Rules under this technique

Sigma 3 rules

Splunk 36 rules

YARA-L 1 rule

Panther 1 rule

Compromise Accounts T1586

Authoring guide

Fields filtered most (51 distinct)

Top indicator values (92 distinct)

Exclusions (14 distinct)

Rules under this technique

Sigma 3 rules

Splunk 36 rules

YARA-L 1 rule

Panther 1 rule

Compromise Accounts `T1586`