Keycloak impossible user travel detected

This rule is part of a beta feature. To learn more, contact Support.
keycloak

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

Set up the keycloak integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Identify instances where users are trying to login from two distant geographical locations within an improbable time frame, potentially indicating credential theft or account compromise.

Strategy

This rule analyzes login events to identify cases where a user appears to perform activities from two different countries or cities within a time frame that would make physical travel between those locations impossible.

Triage and response

  1. Determine if userId {{@usr.id}} connected from {{@impossible_travel.triggering_locations.first_location.city}}, {{@impossible_travel.triggering_locations.first_location.country}} and {{@impossible_travel.triggering_locations.second_location.city}}, {{@impossible_travel.triggering_locations.second_location.country}} in a short period of time.
  2. Check for any failed login attempts or other unusual activities related to the user.
  3. Contact the affected user to verify whether they initiated the login events.
  4. If the user did not perform the logins, restrict their access until their credentials are reset.