Analytics BIOC Informational

A user connected from a new country

A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Module:
Identity Analytics
Data source:
AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:

Gain user-account credentials.

Investigative actions:

Check if the user is currently located in the aforementioned country, or routed its traffic there via a VPN.

Test period:
N/A (single event)
Deduplication:
30 Days
2 variations:
  • A user connected from a new country via a suspicious IP Low (parent: Informational)
  • A user connected from a new country - suspicious characteristics detected Low (parent: Informational)