Analytics BIOC
Informational
✕
A disabled user attempted to authenticate via SSO
A disabled user attempted to authenticate via SSO.
- Module:
- Identity Analytics
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:
Use an account that was possibly compromised in the past to gain access to the network.
Investigative actions:
Confirm that the activity is benign (e.g. the user returned from a long leave of absence). Check whether you have issues with your Cloud Identity Engine failing to sync data from Active Directory.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- A disabled user attempted to authenticate via SSO from a suspicious IP Low (parent: Informational)