Analytics
Low
✕
A user rejected an SSO request from an unusual country
A user rejected an SSO authentication request from an abnormal country.
- Module:
- Identity Analytics
- Data source:
- Okta, OneLogin
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:
An attacker is attempting to gain access to an account secured with MFA.
Investigative actions:
Verify the reject cause of the MFA attempts. Check to see if the user has successfully authenticated around the time of the alert, and confirm it's a legitimate login. Verify the authentication attempt from the rare country is benign.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day