A Successful VPN connection from TOR

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	Requires one of the following data sources: Palo Alto Networks Global Protect OR Third-Party VPNs
Detection Modules	Identity Analytics
ATT&CK Tactic	Initial Access (TA0001) Command and Control (TA0011)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003) Valid Accounts (T1078)
Severity	High

A successful VPN connection from a TOR exit node.

Gain initial access to organization and hiding itself.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

A successful VPN connection from a TOR exit node.

Gain initial access to organization and hiding itself.