User attempted to connect from a suspicious country

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	30 Days
Required Data	Requires one of the following data sources: AzureAD OR Azure SignIn Log OR Duo OR Okta OR OneLogin OR PingOne
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Severity	Informational

A user connected from an unusual country. This may indicate the account was compromised.

Gain user-account credentials.

Check if the user is currently located in the aforementioned country, or routed its traffic there via a VPN.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user successfully connected from an unusual country. This may indicate the account was compromised.

Gain user-account credentials.

Check if the user is currently located in the aforementioned country, or routed its traffic there via a VPN.