The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Reviewing use of service accounts

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

Service accounts are targeted by attackers for two reasons:

  • They are frequently configured to run as highly privileged accounts (example, Domain Admins)

  • Service accounts often log into many systems, expanding the attack surface for obtaining a password hash that can be reused to move laterally in an environment.

:
Related articles
  • Reviewing use of service accounts
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Auditing an environment
  • Reviewing Use of Service Accounts
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Common Investigative Workflows > Auditing an Environment
  • Reviewing logons by privileged accounts
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Auditing an environment