IA-B-04Level 1 · Signal
Signs in from unusual contexts
A risky behavior signal from the identity provider: the person signed in from an unusual location, device, time or network against their own baseline.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- DE.CM-03
- MITRE ATT&CK
-
- T1078
The definition, in detail
Definition
It may be travel, or it may be someone else using the account.
Example
A controller who always works from one city signs in from two countries on the same afternoon.
How it is measured
- Source
- Identity provider & MFA
- Subject
- Person
- Event
- auth.login.unusual
- Risk domain
- Identity and access
- Provenance
- Forrester, Verizon DBIR
How it is used
Programs count "Signs in from unusual contexts" per person from Identity provider & MFA and read it beside the other Identity and access signals; it feeds 1 cohort, 5 sequences and 2 breach scenarios.
A "signs in from unusual contexts" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0024Sends credentials through chat messages
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0127Uses root credentials for cloud administrative access
- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0149Engages in activity inconsistent with approved roles
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0306Reuses home network credentials on corporate systems
- I.0312Uses shared household accounts on corporate devices
- I.0314Uses outdated or insecure VPN protocols
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0362Ignores breach-intel notifications beyond SLA
Continue exploring
"Signs in from unusual contexts" (IA-B-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ia-b-04-signs-in-from-unusual-contexts
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.