Anvilogic high experimental spl

Auth0: Multiple Signins from Same IP [splunk-auth0]

Threat actors may attempt rapid, repeated login attempts to brute-force credentials or exploit session-based authentication limits. This use case detects IPs with multiple successful signins from the same IP.

View Source

Detection Logic

`get_authentication_data_auth0` "succeed" 
OR (TERM(success) TERM(login))
| where match(event_type, "(?i)^s$")
| table _time, host, user, signature, City, Region, Country, src_ip, coi_user
| bin span=6000s
| stats values(*) as * by _time, src_ip
| eventstats dc(src_user) as dc_user by src_ip, _time
| eval start_time=strftime(start_time, "%m/%d/%Y %H:%M:%S")
| eval end_time=strftime(end_time, "%m/%d/%Y %H:%M:%S")
| where dc_user > 1

Field Validations

Loading…

Comments (0)

Loading comments...