A user logged in at an unusual time via SSO

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	Requires one of the following data sources: AzureAD OR Azure SignIn Log OR Duo OR Google Workspace Authentication OR Okta OR OneLogin OR PingOne
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.

An attacker is attempting to evade detection.

Check the login of the user.
Check further actions done by the account (e.g. creating files in suspicious locations, creating users, elevating permissions, etc.).
Check if the user accessing remote resources or connecting to other services.
Check if the user is logging in from an unusual time zone while traveling.
Check if the user usually logs in from this country.

A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.

An attacker is attempting to evade detection.

Check the login of the user.
Check further actions done by the account (e.g. creating files in suspicious locations, creating users, elevating permissions, etc.).
Check if the user accessing remote resources or connecting to other services.
Check if the user is logging in from an unusual time zone while traveling.
Check if the user usually logs in from this country.