Anvilogic high experimental spl
Auth0: Native Social Login [splunk-auth0]
Threat actors may attempt to exploit social login integrations to bypass traditional authentication mechanisms using compromised third-party accounts. This use case detects successful native social login events, which could indicate legitimate user authentication or an attacker leveraging stolen social credentials for account takeover.
Detection Logic
`get_authentication_data_auth0` "sens"
OR "Native Social Login"
| where match(event_type, "(?i)^sens$")
| table _time, host, user, signature, City, Region, Country, userField Validations
Loading…
Comments (0)
Loading comments...