Analytics BIOC Low
✕

A disabled user attempted to log in to a VPN

A disabled user attempted to log in suspiciously to a VPN.

Module:
Identity Analytics
Data source:
Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that was possibly compromised in the past to gain access to the network.

Investigative actions:

See whether the service authentication was successful. Confirm that the activity is benign (e.g. a contractor user). Check whether you have issues with your Cloud Identity Engine failing to sync data from Active Directory.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Possible VPN login attempt by disabled user Informational (parent: Low)