Analytics
Informational
✕
A user accessed multiple unusual resources via SSO
A user accessed multiple resources via SSO that are unusual for this user. This may be indicative of a compromised account.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Discovery (TA0007) Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078) Cloud Service Dashboard (T1538) Cloud Service Discovery (T1526)
Attacker's goals:
Unusual resources may be accessed for various purposes, including exfiltration, lateral movement, etc.
Investigative actions:
Investigate the resources that were accessed to determine if they were used for legitimate purposes or malicious activity.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
3 variations:
- A user accessed multiple resources via SSO using an anonymized proxy Medium (parent: Informational)
- Suspicious user access to multiple resources via SSO Low (parent: Informational)
- Multiple Resource Access from a New IP via SSO Low (parent: Informational)