VPN login attempt by a honey user

Cortex XDR Analytics Alert Reference by data source
Product
Cortex XDR
Last date published
2025-01-19
Category
Analytics Alert Reference
Index by
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Hour

Required Data

  • Requires one of the following data sources:
    • Palo Alto Networks Global Protect
      OR
    • Third-Party VPNs

Detection Modules

Identity Analytics

Detector Tags

Honey User Analytics

ATT&CK Tactic

Initial Access (TA0001)

ATT&CK Technique

Valid Accounts (T1078)

Severity

Low

Description

A VPN login attempt was made by a honey user, a decoy account created specifically to detect unauthorized access. This may indicate potential attacker activity.

Attacker's Goals

An attacker is attempting to gain unauthorized access by exploiting valid or stolen credentials.

Investigative actions

  • Confirm that the alert was triggered by a honey user account.
  • Check for other login attempts on different accounts from the same source IP.
  • Analyze any subsequent actions performed by the user after the login attempt.
  • Follow further actions performed by the user.

Variations

Abnormal VPN login by a honey user

Synopsis

ATT&CK Tactic

Initial Access (TA0001)

ATT&CK Technique

Valid Accounts (T1078)

Severity

Medium

Description

A VPN login attempt was made by a honey user, a decoy account created specifically to detect unauthorized access. This may indicate potential attacker activity.

Attacker's Goals

An attacker is attempting to gain unauthorized access by exploiting valid or stolen credentials.

Investigative actions

  • Confirm that the alert was triggered by a honey user account.
  • Check for other login attempts on different accounts from the same source IP.
  • Analyze any subsequent actions performed by the user after the login attempt.
  • Follow further actions performed by the user.