Analytics BIOC
Informational
✕
A user logged in at an unusual time via SSO
A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.
- Module:
- Identity Analytics
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:
An attacker is attempting to evade detection.
Investigative actions:
Check the login of the user. Check further actions done by the account (e.g. creating files in suspicious locations, creating users, elevating permissions, etc.). Check if the user accessing remote resources or connecting to other services. Check if the user is logging in from an unusual time zone while traveling. Check if the user usually logs in from this country.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour
1 variation:
- Google Workspace - A user logged in at an unusual time via SSO Informational