Inactive Account Probing
Last updated
Last updated
Identifies users who experience a sudden surge in failed login attempts after an extended period of inactivity, which could indicate a potential account takeover attempt.
A user will fail this check if they have been inactive for 30 or more days and encounter at least 2 account probing attempt(s).
Check if the username was in any known data breaches. Prioritize investigating and remediating users without MFA enabled on their accounts, as they are at the highest risk. If an attacker successfully guesses or obtains their password, they can gain access without needing a second form of authentication.
To remediate, start by initiating an access review with the user’s manager to confirm whether the dormant account is still needed. If the probed account is no longer required, deprovision it at the identity source. If the account is still needed (ex: user on leave), disable it at the identity source.
If the probed account is no longer required, deprovision it at the identity source. If the account is still needed (ex: user on leave), disable sign-in's at the identity source.
Otherwise, continue monitoring the account for activity and suspend it after a grace period if inactivity persists. Investigate the source(s) of failed login attempts and update geo-blocking rules if needed.
Number of days: 30
Account probing threshold: 2
