User Accounts - Unusual authentications occurring when countries do not conduct normal business operations.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies users whose single Factor Auth Events in scenarios where it has not been seen before, or where only multi factor auth has been observed.

Attribute	Value
Type	Hunting Query
Solution	Business Email Compromise - Financial Fraud
ID	f56b2223-0d4d-4347-9de4-822d195624ee
Tactics	InitialAccess
Techniques	T1078
Required Connectors	AzureActiveDirectory, BehaviorAnalytics
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
IdentityInfo	✓	✗	?
SigninLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Business Email Compromise - Financial Fraud