Question

A threat hunter at a large enterprise is investigating a possible insider compromise. The UEBA platform flags a service account that normally authenticates only to two database servers during business hours. Over the past 48 hours, the same account authenticated interactively to 14 different workstations across three subnets, all between 01:00 and 04:00, using NTLM. No malware alerts fired, and the account's password has not changed. Which conclusion best explains the value UEBA provided and the most likely activity underway?

Accepted Answer

UEBA detected a deviation from the account's behavioral baseline consistent with credential theft and lateral movement, warranting immediate containment of the account

Answer

UEBA generated a false positive because signature-based antivirus reported no malware, so the analyst should suppress the alert to reduce noise

Answer

UEBA identified a policy violation for after-hours access, and the correct response is to update the acceptable-use policy to permit maintenance windows

Answer

UEBA confirmed a brute-force attack because NTLM was used, and the analyst should enforce a password reset on all affected workstations