Anvilogic high experimental spl

Auth0: MFA Enrollment Started [splunk-auth0]

Threat actors may attempt to enroll their own MFA device on a compromised account to establish persistence and bypass authentication controls. This use case detects the initiation of a new MFA enrollment, which could indicate legitimate user setup or an attacker attempting to register an unauthorized authentication method.

View Source

Detection Logic

`get_authentication_data_auth0` "gd_start_enroll" 
OR "Multi-factor authentication enroll has started"
| where match(event_type, "(?i)^gd_start_enroll$")
| table _time, host, user, signature, City, Region, Country, user
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...