Analytics BIOC Informational
✕

Successful universal authentication with suspicious features

A universal authentication was flagged as suspicious based on anomalous features.

Module:
Identity Analytics
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:

Use an account that was possibly compromised to gain access to the network, while potentially using an anonymizing service to obfuscate their origin.

Investigative actions:

Investigate the suspicious authentication. Verify if the ASN is an approved ASN to authenticate from. Follow further actions done by the user. If the IP is associated with a tunnel operator, check whether it is an approved VPN.

Test period:
N/A (single event)
Deduplication:
1 Day
4 variations:
  • Successful universal authentication sign-in from a TOR exit node Medium (parent: Informational)
  • Successful universal authentication from a suspicious tunnel operator Low (parent: Informational)
  • Suspicious successful universal authentication from ASN Informational
  • Successful universal authentication from a new country in organization Informational