Analytics BIOC Informational
✕

A user logged in from an abnormal country or ASN

A user logged in from an unusual country or ASN. This may indicate that the account was compromised.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:

Gain user-account credentials.

Investigative actions:

Check if the user is currently located in the aforementioned country. Check for any other suspicious activity related to the account. Check other ASNs and Countries that the user logged in from. Look for additional login attempts.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • A service account successfully logged in from a new country or ASN Low (parent: Informational)