First SSO Resource Access in the Organization

Analytics BIOC Informational

First SSO Resource Access in the Organization

A resource was accessed for the first time via SSO.

Module:: Identity Analytics
Data source:: AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

ATT&CK tactics: Initial Access (TA0001) Discovery (TA0007)

ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002) Cloud Service Discovery (T1526)

Attacker's goals:

Use a possibly compromised account to access privileged resources.

Investigative actions:

Confirm that the activity is benign (e.g. this is a newly approved resource). Follow further actions done by the user that attempted to access the resource.

Test period:: N/A (single event)
Deduplication:: 1 Day

1 variation:

Abnormal first access to a resource via SSO in the organization Low (parent: Informational)