Illicit Access to Another Person’s Account

A subject accesses or uses an account assigned to another individual without being provided, delegated, shared, or approved access to that account. The account may belong to a colleague, manager, administrator, contractor, service desk analyst, executive, or other member of the organization’s population.

This behavior may involve the subject independently obtaining or using another person’s password, session token, multi-factor authentication approval, recovery mechanism, device session, browser session, SSH key, API token, or other identity-bound access mechanism. The defining behavior is that the subject performs activity through another person’s account where the account holder has not knowingly provided or authorized the subject’s use.