Auditd Login from Forbidden Location

Identifies that a login attempt has happened from a forbidden location.

Rule type: query
Rule indices:

• auditbeat-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: ``
Maximum alerts per execution: 100
References:

• https://github.com/linux-pam/linux-pam/blob/aac5a8fdc4aa3f7e56335a6343774cc1b63b408d/modules/pam_access/pam_access.c#L412

Tags:

• Elastic
• Host
• Linux
• Threat Detection
• Initial Access

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.module:auditd and event.action:"attempted-log-in-from-unusual-place-to"
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Initial Access
  • Id: TA0001
  • Reference URL: https://attack.mitre.org/tactics/TA0001/

• Technique:

  • Name: Valid Accounts
  • Id: T1078
  • Reference URL: https://attack.mitre.org/techniques/T1078/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Persistence
  • Id: TA0003
  • Reference URL: https://attack.mitre.org/tactics/TA0003/

• Technique:

  • Name: Valid Accounts
  • Id: T1078
  • Reference URL: https://attack.mitre.org/techniques/T1078/