Logins originating from VPS Providers

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query searches for successful logons from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.

Attribute	Value
Type	Hunting Query
Solution	Okta Single Sign-On
ID	f262fc3a-0acc-4c8b-9a73-fdc09f55fff2
Tactics	InitialAccess
Techniques	T1078
Required Connectors	OktaSSO, OktaSSOv2
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
OktaV2_CL	?	✓	?
Okta_CL 🔶	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Okta Single Sign-On