Analytics BIOC Informational
✕

First VPN access from ASN in organization

A VPN connection was attempted from a new ASN.

Module:
Identity Analytics
Data source:
Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)
Attacker's goals:

Use an account that was possibly compromised to gain access to the network.

Investigative actions:

See whether the connection was successful. Confirm that the activity is benign (e.g. the provider or location is allowed or a new user). Verify if the ASN is an approved ASN to authenticate from. Follow further actions done by the user.

Test period:
N/A (single event)
Deduplication:
1 Day