Esc

Local Account Monitoring

D3-LAM
D3-LAM (Local Account Monitoring)

Definition

Analyzing local user accounts to detect unauthorized activity.

loading...
json
loading...

References

All
Guideline
External Knowledge Base
Source Code

The following references were used to develop the Local Account Monitoring knowledge-base article.

(Note: the consideration of references does not imply specific functionality exists in an offering.)

Audit User Account Management

Reference Type: Guideline Organization: Microsoft
Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-account-management

Reference - CAR-2016-04-004: Successful Local Account Login

Reference Type: External Knowledge Base
Source: https://car.mitre.org/analytics/CAR-2016-04-004/

OS Query Windows User Collection Code

Reference Type: Source Code
Source: https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/windows/users.cpp

A knowledge graph of cybersecurity countermeasures