A user rejected an SSO request from an unusual country

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires all of the following: Okta OneLogin
Detection Modules	Identity Analytics
ATT&CK Tactic	Credential Access (TA0006), Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586), Brute Force: Password Guessing (T1110.001)
Severity	Low

Description

A user rejected an SSO authentication request from an abnormal country.

Attacker's Goals

An attacker is attempting to gain access to an account secured with MFA.

Investigative actions

• Verify the reject cause of the MFA attempts.
• Check to see if the user has successfully authenticated around the time of the alert, and confirm it's a legitimate login.
• Verify the authentication attempt from the rare country is benign.