Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the keycloak integration.

Goal

Identify instances where users are trying to login from two distant geographical locations within an improbable time frame, potentially indicating credential theft or account compromise.

Strategy

This rule analyzes login events to identify cases where a user appears to perform activities from two different countries or cities within a time frame that would make physical travel between those locations impossible.

Triage and response

1. Determine if userId {{@usr.id}} connected from {{@impossible_travel.triggering_locations.first_location.city}}, {{@impossible_travel.triggering_locations.first_location.country}} and {{@impossible_travel.triggering_locations.second_location.city}}, {{@impossible_travel.triggering_locations.second_location.country}} in a short period of time.
2. Check for any failed login attempts or other unusual activities related to the user.
3. Contact the affected user to verify whether they initiated the login events.
4. If the user did not perform the logins, restrict their access until their credentials are reset.