Anvilogic high experimental spl

Auth0: MFA Enrollment Failed [splunk-auth0]

Threat actors may attempt to enroll a new MFA device on a compromised account but fail due to security controls, user intervention, or misconfiguration. This use case detects failed MFA enrollment attempts, which could indicate an attacker trying to register an unauthorized authentication method or issues with legitimate user enrollment.

View Source

Detection Logic

`get_authentication_data_auth0` "gd_start_enroll_failed" 
OR "Push to start enrollement failed"
| where match(event_type, "(?i)^gd_start_enroll_failed$")
| table _time, host, user, signature, City, Region, Country, user
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...