Detection of Generic User Account Usage
This query identifies the use of generic or shared user accounts by leveraging a predefined lookup file containing known default and non-personalized usernames (e.g., admin, test, root).
CQL · Falcon Next-Gen SIEMCopy query
"#event_simpleName" = UserLogon | user.name := lower("user.name") | groupBy(user.name,ComputerName) | match(file="generic-usernames.csv", field=[user.name], column=[username])
| table([user.name, ComputerName, _count])
| User := rename(user.name)
| Host := rename(ComputerName)
| LogonCount := rename(_count)| Framework | Primary Reason | Specific Source / Control |
|---|---|---|
| PCI DSS | Individual Accountability | Requirement 8.2.1 |
| HIPAA | Traceability of PHI Access | 45 CFR § 164.312(a)(2)(i) |
| ISO 27001 | Privileged Access Control | Annex A 5.15 / 8.2 |
| NIST 800-53 | Risk Management | AC-2(9) |
| SOC 2 | Auditability | CC6.1 |
detection_of_generic_user_account_usage.yml
T1078
ByteRay GmbH
Detection
Endpoint
Insight
2026-03-19
2026-03-19
