Anomalous Authentication Consistent with Infostealer Credential Reuse
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
Splunk (SPL)
