Analytics Low

A user rejected an SSO request from an unusual country

A user rejected an SSO authentication request from an abnormal country.

Module:
Identity Analytics
Data source:
Okta, OneLogin
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:

An attacker is attempting to gain access to an account secured with MFA.

Investigative actions:

Verify the reject cause of the MFA attempts. Check to see if the user has successfully authenticated around the time of the alert, and confirm it's a legitimate login. Verify the authentication attempt from the rare country is benign.

Test period:
1 Hour
Deduplication:
1 Day