Anvilogic high experimental spl
Auth0: MFA Device Updated [splunk-auth0]
Threat actors may update MFA device settings to replace the legitimate user’s authentication method with one they control, ensuring persistent access. This use case detects updates to MFA devices, which could indicate an attacker modifying authentication factors after compromising an account.
Detection Logic
`get_authentication_data_auth0` "gd_update_device_account"
OR "Device used for second factor authentication has been updated"
| where event_type="gd_update_device_account"
| table _time, host, user, signature, City, Region, Country, src_ip, coi_user
| bin span=1s
| stats values(*) as * by _time, src_ipField Validations
Loading…
Comments (0)
Loading comments...