Authentication attempt by a honey user

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	Requires one of the following data sources: AzureAD OR Okta OR OneLogin OR PingOne
Detection Modules	Identity Analytics
Detector Tags	Honey User Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low

Description

An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Attacker's Goals

An attacker is attempting to gain unauthorized access by exploiting valid or stolen credentials.

Investigative actions

• Confirm that the alert was triggered by a honey user account.
• Check for other authentication attempts on different accounts from the same source IP.
• Analyze any subsequent actions performed by the user after the authentication attempt.
• Follow further actions performed by the user.

Variations

Abnormal authentication by a honey user

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Medium

Description

An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Attacker's Goals

An attacker is attempting to gain unauthorized access by exploiting valid or stolen credentials.

Investigative actions

• Confirm that the alert was triggered by a honey user account.
• Check for other authentication attempts on different accounts from the same source IP.
• Analyze any subsequent actions performed by the user after the authentication attempt.
• Follow further actions performed by the user.