Analytics BIOC Informational
✕

First VPN access from ASN for user

A user logged in to a VPN with a new ASN.

Module:
Identity Analytics
Data source:
Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that was possibly compromised to gain access to the network.

Investigative actions:

Confirm that the activity is benign (e.g. the user has switched locations and providers). Verify if the ASN is an approved ASN to authenticate from. Follow further actions done by the user.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Unusual VPN access from ASN Low (parent: Informational)