A successful SSO sign-in from TOR

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	Requires one of the following data sources: AzureAD OR Azure SignIn Log OR Duo OR Okta OR OneLogin OR PingOne
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Initial Access (TA0001) Command and Control (TA0011)
ATT&CK Technique	Proxy: Multi-hop Proxy (T1090.003) Valid Accounts (T1078)
Severity	High

A successful sign-in from a TOR exit node.

Gain initial access to organization and hiding itself.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

A successful sign-in from a TOR exit node.

Gain initial access to organization and hiding itself.