user-switching

name	user-switching
description	Investigate whether one account logs into a system and a different account logs in from that same system shortly after, which can indicate a handoff between operators, credential theft, or a shared workstation being used to launder access. Use when given authentication logs and asked to check for user switching, session handoff, or "did a different account pick up from here."

User Switching

MITRE ATT&CK: T1078 (Valid Accounts); may co-occur with T1550 (Use Alternate Authentication Material) if the switch is enabled by stolen tokens/hashes rather than a second legitimate credential.

1. Which question am I trying to answer?

Did User A log into System X, and then did User B log in from System X shortly afterward — i.e., did the acting identity change on the same machine within a short window?

2. Which direct evidence do I need?

Per authentication event: Time, Source, Destination, User, Success/ Failure, Logon Type. The signal is a change in user for consecutive events sharing the same source machine, within a bounded time gap.

3. Where do I get that data?

• Windows Security.evtx: Event ID 4624/4634 on the machine acting as source for the next hop — i.e., you need visibility into logons on System X (who's interactively logged in) as well as authentication attempts from System X to other destinations.
• Interactive logon events specifically (Logon Type 2, or 10 for RDP) on System X establish who was "at the keyboard" before the next outbound authentication — a network logon (Logon Type 3) doesn't necessarily mean anyone switched who's sitting at the console.
• EDR endpoint telemetry (active user session, process owner) as a corroborating source when raw event logs are ambiguous about which account was interactively active at a given moment.

4. How do I analyze that data to answer the question?

Normalize into the shared schema (timestamp, user, source, destination, success, logon_type), then run:

python3 scripts/analyze.py --input auth_events.csv --max-gap-minutes 15

Logic: group successful logons by source, sort by time, and walk consecutive pairs — whenever the user changes between one event and the next on the same source, and the gap is within --max-gap-minutes, flag the transition User A -> User B @ source.

Tuning: 15 minutes approximates a plausible "same physical session, different login" window (e.g., someone else sitting down at a shared kiosk/terminal). Shorten it if you specifically want same-minute handoffs that look automated rather than human-paced.

5. What answer does the analysis provide?

A list of (source, User A, User B, gap) transitions. Interpretation:

• Shared/kiosk workstations (help desk terminals, shared lab machines, RDP jump boxes used by a rotating on-call team) will legitimately show this pattern constantly — this analytic is far more useful on workstations that are supposed to be single-user (named employee laptops/desktops) than on shared infrastructure.
• A privileged account appearing as "User B" shortly after a standard user's session on the same host is the highest-priority variant — it can indicate privilege escalation via stolen credentials cached or entered on that machine.
• No corresponding logoff by User A before User B appears strengthens the finding (User A didn't cleanly hand off the machine) — cross-check 4634/4647 for User A around the transition time.
• A single instance is weak evidence on its own; a pattern of the same User A -> User B transition recurring across time, or User B showing up after many different "User A" accounts on many hosts, is far more suspicious than an isolated one-off.