| name | user-switching |
| description | Investigate whether one account logs into a system and a different account logs in from that same system shortly after, which can indicate a handoff between operators, credential theft, or a shared workstation being used to launder access. Use when given authentication logs and asked to check for user switching, session handoff, or "did a different account pick up from here." |
User Switching
MITRE ATT&CK: T1078 (Valid Accounts); may co-occur with T1550 (Use
Alternate Authentication Material) if the switch is enabled by stolen
tokens/hashes rather than a second legitimate credential.
1. Which question am I trying to answer?
Did User A log into System X, and then did User B log in
from System X shortly afterward — i.e., did the acting identity change on
the same machine within a short window?
2. Which direct evidence do I need?
Per authentication event: Time, Source, Destination, User, Success/
Failure, Logon Type. The signal is a change in user for consecutive
events sharing the same source machine, within a bounded time gap.
3. Where do I get that data?
- Windows Security.evtx: Event ID
4624/4634 on the machine acting as
source for the next hop — i.e., you need visibility into logons on
System X (who's interactively logged in) as well as authentication
attempts from System X to other destinations.
- Interactive logon events specifically (
Logon Type 2, or 10 for
RDP) on System X establish who was "at the keyboard" before the next
outbound authentication — a network logon (Logon Type 3) doesn't
necessarily mean anyone switched who's sitting at the console.
- EDR endpoint telemetry (active user session, process owner) as a
corroborating source when raw event logs are ambiguous about which
account was interactively active at a given moment.
4. How do I analyze that data to answer the question?
Normalize into the shared schema (timestamp, user, source, destination, success, logon_type), then run:
python3 scripts/analyze.py --input auth_events.csv --max-gap-minutes 15
Logic: group successful logons by source, sort by time, and walk
consecutive pairs — whenever the user changes between one event and the
next on the same source, and the gap is within --max-gap-minutes, flag the
transition User A -> User B @ source.
Tuning: 15 minutes approximates a plausible "same physical session,
different login" window (e.g., someone else sitting down at a shared
kiosk/terminal). Shorten it if you specifically want same-minute handoffs
that look automated rather than human-paced.
5. What answer does the analysis provide?
A list of (source, User A, User B, gap) transitions. Interpretation:
- Shared/kiosk workstations (help desk terminals, shared lab machines,
RDP jump boxes used by a rotating on-call team) will legitimately show
this pattern constantly — this analytic is far more useful on
workstations that are supposed to be single-user (named employee
laptops/desktops) than on shared infrastructure.
- A privileged account appearing as "User B" shortly after a standard
user's session on the same host is the highest-priority variant — it can
indicate privilege escalation via stolen credentials cached or entered on
that machine.
- No corresponding logoff by User A before User B appears strengthens
the finding (User A didn't cleanly hand off the machine) — cross-check
4634/4647 for User A around the transition time.
- A single instance is weak evidence on its own; a pattern of the same
User A -> User B transition recurring across time, or User B showing up
after many different "User A" accounts on many hosts, is far more
suspicious than an isolated one-off.
