Analytics BIOC Informational
✕

A user connected to a VPN from a new country

A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Module:
Identity Analytics
Data source:
Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:

Use an account that was possibly compromised to gain access to the network.

Investigative actions:

See whether the service authentication was successful. Confirm that the activity is benign (e.g. the user has switched locations and providers). Verify if the country is an approved country to connect from. Follow further actions done by the user.

Test period:
N/A (single event)
Deduplication:
30 Days
1 variation:
  • A user connected to a VPN from a suspicious country Low (parent: Informational)