Anvilogic high experimental spl
Auth0: MFA Device Update Failure [splunk-auth0]
Threat actors may use attempt to bypass MFA or establish persistence by linking a controlled device to a compromised account. This use case detects failed device authorization (fdeaz) and failed device activation (fdeac), which could indicate attempts to enroll a new device being blocked by security controls.
Detection Logic
`get_authentication_data_auth0` "Device authorization request failed."
OR "fdeaz"
OR "Failed to activate device"
OR "fdeac"
| where match(event_type, "fdeac
| fdeaz")
| table _time, host, user, signature, City, Region, Country, src_ip, coi_user
| bin span=1s
| stats values(*) as * by _time, src_ipField Validations
Loading…
Comments (0)
Loading comments...