Essentials for cloud
DET-04 Baselined high-risk access activities
Keep a baseline of normal use for your identities, services and software, and keep watching and analysing activity against it. This helps you spot legitimate accounts or tools being used in unusual ways, such as by an attacker.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.
The action
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 1
Continuously monitor and analyse baselining to detect anomalous usage of legitimate identities, services and software.
In plain English: Keep watching and analysing activity against your baselines of normal use. Look for legitimate identities, services and software being used in unusual ways.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSProvider-inherited
- SaaSProvider-inherited
- MITRE ATT&CK
- Valid Accounts
- Account Manipulation
- Use Alternate Authentication Material
- Remote Access Tools
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.