Analytics BIOC
Informational
✕
First connection from a country in organization
A user connected to an SSO service from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised.
- Module:
- Identity Analytics
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:
Gain user-account credentials.
Investigative actions:
Check if the user is currently located in the aforementioned country, or routed its traffic there via a VPN.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- First connection from a country in organization via a suspicious IP Low (parent: Informational)
- First successful SSO connection from a country in organization Informational