admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove city from decription

Browse Source
This commit is contained in:
Bhavin Patel
2024-08-22 18:26:06 +05:30
committed by GitHub
parent de9ee3217b
commit ffe4b1cbe9
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml
+1 -2
View File
@@ -8,8 +8,7 @@ type: TTP
description: The following analytic detects an Azure AD account with concurrent sessions
originating from multiple unique IP addresses within a 5-minute window. It leverages
Azure Active Directory NonInteractiveUserSignInLogs to identify this behavior by
analyzing successful authentication events and counting distinct source IPs and cities per
user. This activity is significant as it may indicate session hijacking, where an
analyzing successful authentication events and counting distinct source IPs. This activity is significant as it may indicate session hijacking, where an
attacker uses stolen session cookies to access corporate resources from a different
location. If confirmed malicious, this could lead to unauthorized access to sensitive
information and potential data breaches.