Anvilogic high experimental spl

Auth0: WebAuthn Enrollment Failed [splunk-auth0]

Threat actors may attempt to enroll a rogue WebAuthn device on a compromised account but fail due to security controls, misconfiguration, or lack of proper credentials. This use case detects failed WebAuthn enrollment attempts, which could indicate an attacker attempting to register an unauthorized authentication method or legitimate user enrollment issues.

View Source

Detection Logic

`get_authentication_data_auth0` "gd_webauthn_enrollment_failed" 
OR "WebAuthn browser enrollment failed"
| where match(event_type, "(?i)^gd_webauthn_enrollment_failed$")
| table _time, host, user, signature, City, Region, Country, user
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...