gensecaihq/wazuh-autopilot/identity-compromise

Identity Compromise Investigation

Accounts are the most common path to impact. Decide whether an account is compromised, how far it was used, and what containment is justified.

Key events and the Wazuh rules that surface them

Rule numbers are from the stock Wazuh 4.14 ruleset. Many Windows events are only alerted on when the channel is collected and not filtered. If there's no rule, search the raw event with search_security_events (field data.win.system.eventID). Load wazuh-windows-sysmon for Windows field paths.

Procedure

1. List all auth events for the user over 7 days (search_security_events(query="<user>")),

and aggregate by source IP and host (get_alerts_aggregated).

1. Establish baseline: usual source IPs, hosts, hours, logon types.
2. Test each hypothesis below; record which are supported.
3. Determine scope: every host the account touched after the suspected compromise time.

Hypotheses and indicators

Verdict

• Compromised — success from attacker-controlled source, or malicious actions by the

account. Confidence ≥ 0.8.

• Targeted, not compromised — failures only, no success. Recommend blocking the source,

not disabling the user.

• Inconclusive — anomalies without malicious actions; recommend user verification.

Recommend disable_user (proposed by response-planner) only with evidence of successful malicious use. Service accounts and break-glass accounts: flag the business impact explicitly; prefer blocking the source or isolating the host first.

Output

• add_entities (user as victim; source IPs as attacker; hosts touched).
• link_mitre for supported techniques.
• update_case severity/confidence.
• add_finding titled Identity assessment: <user> with baseline, hypotheses table

(supported / not supported + evidence), hosts in scope, verdict, recommended containment. standard_refs: NIST-800-61r3, CIS-v8.1:5 (Account Management), CIS-v8.1:6 (Access Control Management).