Overview
Account compromise indicators are the combined signals that an account has been taken over. This capstone lesson consolidates authentication anomalies.
Learning objectives
- Identify indicators of account compromise.
- Explain combining signals for detection.
- Consolidate the authentication-anomalies module.
Core concept
Account compromise indicators are the signals — especially in combination — that an account has been taken over by an attacker. They include the authentication anomalies from this module (failed-login patterns then success, impossible travel, unusual devices, suspicious MFA events) plus post-login anomalies: access to resources the user doesn't normally touch, unusual data access/download, off-hours activity, changes to account settings (MFA enrollment, forwarding rules, permissions), and lateral movement. No single indicator is conclusive, but a cluster of them, correlated by account and time, strongly indicates compromise. Recognizing account compromise is critical because a taken-over account gives an attacker legitimate-looking access — often the foothold for broader intrusion. Detection combines the authentication signals with behavioral anomalies via correlation, and confirmed compromise triggers incident response.
How it works
The analyst detects account compromise by combining and correlating indicators. Authentication-phase signals (this module): failed logins followed by a success, impossible travel, unusual device, MFA denials/fatigue — suggest illegitimate access at login. Post-compromise signals: the account accessing unusual resources, downloading/exfiltrating data, acting off-hours, making account changes (adding MFA factors, setting email-forwarding rules to exfiltrate mail, changing permissions), or moving laterally. Correlating these by account and time (SIEM, module 5) builds the case: a login anomaly plus anomalous subsequent activity is far stronger than either alone. Confirmed compromise prompts response: force credential reset, revoke sessions/tokens, remove attacker-added MFA factors/forwarding rules, investigate scope (what was accessed/taken), and escalate to incident response (modules 14-15). This consolidates authentication anomalies — failed logins, impossible travel, unusual devices, MFA events, and compromise indicators — into detecting account takeover, one of the most common and consequential threats, since compromised accounts are a primary attacker entry and pivot point.
Practical example
The SOC assembles account compromise indicators for an account: a password-spraying success (failed logins then a success), from an unusual device in an impossible-travel location, followed by off-hours access to sensitive resources the user never normally touches, plus a newly-added email-forwarding rule (to exfiltrate mail) and an added MFA factor (attacker persistence). No single signal was conclusive, but correlated by account and time, the cluster clearly indicates account takeover. The SOC responds: reset credentials, revoke sessions, remove the forwarding rule and rogue MFA factor, assess what was accessed, and escalate to incident response. Combining the signals turned scattered anomalies into a confirmed, actioned compromise — consolidating the whole module.
Cybersecurity relevance
Account compromise is one of the most common and consequential threats — a taken-over account gives attackers legitimate-looking access, often the foothold for broader intrusion — so detecting it is a core SOC goal. It's detected by combining authentication anomalies (failed logins→success, impossible travel, unusual devices, MFA events) with post-login anomalies (unusual resource/data access, off-hours activity, account changes like forwarding rules and MFA enrollment, lateral movement), correlated by account and time (module 5). Confirmed compromise triggers incident response (credential reset, session revocation, scope assessment; modules 14-15). This consolidates authentication anomalies into account-takeover detection — linking authentication monitoring to the broader incident-response lifecycle central to the SOC.
Common mistakes
- Relying on a single indicator rather than a correlated cluster of signals.
- Stopping at the login anomaly without checking post-compromise activity (data access, forwarding rules, added MFA factors).
- Incomplete response (resetting the password but not revoking sessions or removing attacker persistence like forwarding rules/MFA factors).
Key takeaways
- Account compromise indicators combine authentication anomalies (failed logins→success, impossible travel, unusual devices, MFA events) with post-login anomalies (unusual access, data exfiltration, off-hours, account changes, lateral movement).
- No single indicator is conclusive; a correlated cluster (by account and time) strongly indicates takeover — compromised accounts are a primary attacker foothold and pivot.
- Confirmed compromise triggers incident response (reset credentials, revoke sessions, remove attacker persistence, assess scope); this consolidates authentication anomalies into account-takeover detection.
Check your understanding
- What authentication-phase and post-login indicators together signal account compromise?
- Why is correlating a cluster of signals stronger than any single one, and what response does confirmed compromise trigger?