Dormant Basic Auth API Accounts

This page describes the nowisor-basic-auth-stale-api-accounts check (new in pack v1.1.0). It flags dormant accounts that retain a Basic Auth API path, using two valid dormancy signals.

What this finding means

Dormant accounts with static Basic Auth credentials are standing attack surface with no offsetting business use. The naive test — "account with an API path that hasn't logged in for 90 days" — is wrong for web-service-access-only accounts, because WSAO accounts cannot log into the UI by definition, so their last_login_time is structurally empty (confirmed on dev265147: every active WSAO account returned an empty or years-old value). Using it would false-flag every legitimate out-of-box service account.

This check uses two valid signals instead:

1. Tracked-but-unused — a record in sys_user_basic_auth_exception whose last_seen (real Basic Auth usage recency) is older than the threshold.
2. Dormant hybrid — an active, non-WSAO holder of the allow-list role whose last UI login is stale or never (valid because a non-WSAO account can log into the UI; a likely-departed human retaining an API path).

The threshold defaults to 90 days and is configurable in the check.

Why it matters

Every dormant account with a live Basic Auth credential is a credential an attacker can use and no one is watching. Reducing them shrinks the pre-enforcement attack surface and removes accounts that would otherwise need an allow-list exception nobody actually needs.

How to remediate

Revoke the Basic Auth API path or deactivate the account. For tracked-but-unused accounts, confirm no integration still depends on them, then deactivate or convert. For dormant hybrids (a departed human retaining the role), remove the role and disable the account. (Pure WSAO service-account dormancy is better judged from API-usage telemetry — the log-export sensor — than from UI login, which is why this check does not flag WSAO accounts on last_login_time.)

Verified against ServiceNow Zurich Patch 6 (dev265147), 2026-06-11.