UBA Compromised Account Detection: Three Key Activities

Quick Answer

Accessing sensitive files after hours is exactly the kind of temporal anomaly User Behavior Analytics is built to catch, because UBA doesn't evaluate access requests against a fixed permissions list the way traditional access control does. It builds a rolling baseline of when, where, and how each individual user normally works, then scores deviations from that baseline. A login or file access that falls well outside a user's typical working hours breaks the temporal pattern in the same way that authenticating from an unfamiliar system breaks the pattern for other UBA categories, so the same test applies: is this happening at a time, place, or system the user doesn't normally touch? That's also why UBA maps naturally onto MITRE ATT&CK technique T1078 (Valid Accounts): attackers who steal legitimate credentials still can't perfectly imitate the account owner's habitual schedule and access footprint, so their activity stands out statistically even though the login itself is technically valid. Contrast this with rule-based detection, which would need an explicit policy forbidding after-hours access to catch the same event; UBA instead learns the baseline automatically per user. On future questions, look for language describing activity that is technically permitted but behaviorally unusual for that specific person, since that's the signature UBA and UEBA platforms are designed to surface.