Use Case: Identity
Dormant account reactivation
An account inactive for 11 months suddenly logged in from a new IP at 4 AM and accessed the AWS console for the first time. The employee left 8 months ago. ManySignal flagged it in 60 seconds.
The account that should have been disabled
Dormant accounts represent a persistent access gap. An employee leaves, their accounts are partially offboarded — the primary SSO account is disabled, but the AWS IAM user, the GitHub access, and the old JIRA account persist. An attacker who finds these credentials from a breach dataset or social engineering can access live systems months or years after the employee departed, using credentials that nobody is actively monitoring.
rule: dormant_account_reactivation
type: behavioral_baseline
trigger:
- condition: |
account.last_auth_days > 90
AND authentication.success == true
enrichments:
- hr_status: employment_status, termination_date
- auth_context: ip_geolocation, device_fingerprint
- post_auth_activity: first_10m_api_calls
- account_permissions: current_access_scope
mitre: T1078 (Valid Accounts), T1098 (Account Manipulation)MITRE ATT&CK mapping
Dormant account FAQ
What counts as a 'dormant' account in ManySignal?
ManySignal defines dormant as no authentication activity for 90 days by default. The threshold is configurable — some organizations use 30 or 60 days for privileged accounts. Service accounts with no API calls in 180 days are flagged separately. Accounts created but never used (zero-day dormancy) are flagged immediately.
Why would an attacker reactivate a dormant account specifically?
Dormant accounts are attractive targets because they're less likely to have owners who notice unusual activity, they may have retained elevated permissions from a past role, and they're less likely to be covered by active monitoring. Attackers who compromise a directory database or password spray list often specifically target accounts with no recent login activity.
Does this detection help with access certification compliance?
Yes. Dormant account discovery is a core requirement for SOC 2, ISO 27001, PCI DSS, and HIPAA access review controls. ManySignal generates a monthly dormant account report suitable for access certification evidence, and can automatically disable accounts that pass the dormancy threshold without requiring manual review.
Can ManySignal automatically disable dormant accounts?
Automatic disablement is available as a configurable autonomous action with a grace period and notification. The typical flow: account crosses dormancy threshold → notification to account owner and manager → 7-day grace period → auto-disable if no response. All steps are logged for audit purposes.
Catch dormant account abuse before the attacker finds their footing
90-day behavioral baseline with HR integration to catch accounts that should no longer be active.