t1550 | LoFP

t1550

Title	Tags
a user may have multiple sessions open at the same time, such as on a mobile device and a laptop.	t1550 okta elastic
administrator activity	t1069 t1069.002 t1087 t1087.002 t1550 t1550.002 windows sigma
assumerole from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1548 t1550 t1550.001 aws sigma
assumerole may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.	t1548 t1550 t1550.001 aws sigma
automated processes that uses terraform may lead to false positives.	t1078 t1548 t1550 t1550.001 aws sigma
aws administrators or automated processes might regularly assume roles for legitimate administrative purposes and to perform periodic tasks such as data backups, updates, or deployments.	t1548 t1550 t1556 aws elastic
based on microsoft documentation, legacy systems or applications will use rc4-hmac as the default encryption for tgt requests. specifically, systems before windows server 2008 and windows vista. newer systems will use aes128 or aes256.	t1550 endpoint splunk
custom applications may leverage the kerberos protocol. filter as needed.	t1550 endpoint splunk
developers may leverage third-party applications for legitimate purposes in google workspace such as for administrative tasks.	t1078 t1550 google_workspace elastic
environments that use ntlmv1	t1550 t1550.002 windows sigma
getsessiontoken may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. getsessiontoken from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1548 t1550 aws elastic
getsignintoken events will occur when using aws sso portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. non-sso configured roles would be abnormal and should be investigated.	t1021 t1021.007 t1550 t1550.001 aws sigma
go utilities that use staaldraad awesome ntlm library	t1059 t1087 t1114 t1550 t1550.002 windows sigma
if key credentials are regularly assigned to users, these events will need to be tuned out.	t1222.001 t1550 endpoint splunk
legacy hosts	t1550 t1550.002 windows sigma
legitimate remote administration activity	t1550 windows sigma
legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. access denials may also happen when automated processes are using outdated credentials or when new bedrock features are being explored.	t1078 t1550 aws account splunk
role chaining can be used as an access control. ensure that this behavior is not part of a legitimate operation before taking action.	t1548 t1550 aws elastic
runas command-line tool using /netonly parameter	t1550 t1550.002 windows sigma
saml provider being updated from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.	t1078 t1548 t1550 t1550.001 aws sigma
this is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary.	t1021 t1550 aws elastic
this pattern may occur during legitimate device switching or roaming between networks (e.g., corporate to mobile). developers or power users leveraging multiple environments may also trigger this detection if session persistence spans ip ranges. still, this behavior is rare and warrants investigation when rapid ip switching and graph access are involved.	t1078 t1550 azure elastic
web browsers and third party application might generate similar activity. an initial baseline is required.	t1550 t1550.003 t1558 t1558.003 windows sigma