Analytics Low
✕

Impossible traveler - SSO

User connected from several remote countries, at least one of which is not commonly used in the organization, within a short period of time. This may indicate the account is compromised.

Module:
Identity Analytics
Data source:
AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:

Gain user-account credentials.

Investigative actions:

Check if the user routed their traffic via a VPN, or shared their credentials with a remote employee.

Test period:
6 Hours
Deduplication:
1 Day
3 variations:
  • Impossible traveler - non-interactive SSO authentication Informational (parent: Low)
  • Possible Impossible traveler via SSO Informational (parent: Low)
  • SSO impossible traveler from a VPN or proxy Informational (parent: Low)