ID | Technique | Tactic |
---|---|---|
T1621 | Multi-Factor Authentication Request Generation | Credential Access |
T1556.006 | Multi-Factor Authentication | Credential Access |
T1098.005 | Device Registration | Defense Evasion |
Detection: PingID Mismatch Auth Source and Verification Response
Description
The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
Search
1`pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*") NOT "result.message" IN ("*pair*","*create*","*delete*"))
2| eval user = upper('actors{}.name'), session_id = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', object = 'resources{}.devicemodel', status = 'result.status'
3| join user session_id [ search `pingid` ("result.status" IN ("POLICY") AND "resources{}.ipaddress"=*) AND "result.message" IN("*Action: Authenticate*","*Action: Approve*","*Action: Allowed*")
4| rex field=result.message "IP Address: (?:N\/A)?(?<policy_ipaddress>.+)?\n"
5| rex field=result.message "Action: (?:N\/A)?(?<signature>.+)?\n"
6| rex field=result.message "Requested Application Name: (?:N\/A)?(?<Requested_Application_Name>.+)?\n"
7| rex field=result.message "Requested Application ID: (?:N\/A)?(?<Requested_Application_ID>.+)?\n"
8| eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name)
9| fields app, user, session_id, src, signature ]
10| iplocation prefix=auth_ dest
11| iplocation prefix=verify_ src
12| stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason
13| where auth_Country != verify_Country
14| `security_content_ctime(firstTime)`
15| `security_content_ctime(lastTime)`
16| `pingid_mismatch_auth_source_and_verification_response_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
PingID | N/A | 'XmlWinEventLog' |
'XmlWinEventLog:Security' |
N/A |
Macros Used
Name | Value |
---|---|
pingid | source=PINGID |
pingid_mismatch_auth_source_and_verification_response_filter | search * |
pingid_mismatch_auth_source_and_verification_response_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
Known False Positives
False positives may be generated by users working out the geographic region where the organizations services or technology is hosted.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
An authentication by [$user$] was detected from [$dest$ - $auth_Country$] and the verification was received from [$src$ - $verify_Country$]. | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | PINGID |
_json |
Integration | ✅ Passing | Dataset | PINGID |
_json |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2