Roles Activated Too Frequently (645fd80d-6c07-435b-9e06-7bc1b5656cba)
Identifies when the same privilege role has multiple activations by the same user.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) | Attack Pattern | Roles Activated Too Frequently (645fd80d-6c07-435b-9e06-7bc1b5656cba) | Sigma-Rules | 1 |