First SSO access from an uncommon ASN by user

[DragomirGaliaIT]

Hello everyone,

Recently we started getting these types of incidents in our SOC team for Cortex XDR.

It shows that the user connected with SSO using this ASN.

However, it says that the ASN 263461 is suspicious but we can't verify it with lookup tool.

Any idea how to investigate this properly?

Alert info:

The user  successfully authenticated via SSO. The user accessed SSO via ASN 263461. This ASN is used by 0 users in the organization. The user has not used this ASN in the past 30 days.

Let me know if there's any other info that you need in order to help me out.

Best regards.

[aleksandar.astardzhiev]

Hi @DragomirGaliaIT ,

The alert only says the ASN is uncommon for your organization. This is different from saying ASN is suspicious.

This alert is raised by XDR Analytics, which in nutshell look for anomalies in your log data. Anomaly by itself doesn't mean something is malicious/suspicious.

In this specific case XDR notify you that user have performed SSO  with IP from ASN that was not used by any other of your users for the last 30 days. It is up to your to verify if that user is currently traveling and it is expected for him to connect from such ASN (based on his geo-location).

My first suggestion is to pay more attention to the alert  - it is common misconception that uncommon/rare = suspicious or malicious.

We receive similar alerts, but for GP login. So what we usually do is to check and confirm if this users is indeed traveling at the moment and if it is expected for him to connect to such ASN. If we cannot confirm this by other information we contact the user or some manager to confirm

[DragomirGaliaIT]

Thanks for the explanation. It was indeed regular connection, user has connected using NordVPN for this. Nothing suspicious at all.