Anvilogic high experimental spl

Auth0: WebAuthn MFA Fail [splunk-auth0]

Threat actors may attempt to bypass WebAuthn-based MFA but fail due to incorrect credentials, lack of access to the required device, or security controls preventing authentication. This use case detects failed WebAuthn verification attempts, which could indicate an attacker attempting to gain unauthorized access or a legitimate user experiencing authentication issues.

View Source

Detection Logic

`get_authentication_data_auth0` "gd_webauthn_challenge_failed" 
OR "User failed to verify Webauthn factor"
| where match(event_type, "(?i)^gd_webauthn_challenge_failed$")
| table _time, host, user, signature, City, Region, Country, user
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...