Detections
- ID: DT050
- Created: 05th June 2024
- Updated: 05th June 2024
- Platform: Windows
- Contributor: The ITM Team
Impossible Travel
Custom or pre-built detection logic can be used to determine if a user account has authenticated from two geographic locations in a period of time that is not feasible for legitimate travel between the locations.
Sections
| ID | Name | Description |
|---|---|---|
| IF011 | Providing Access to a Unauthorized Third Party | A subject intentionally provides system or data access to a third party that is not authorized to access it. |
| IF011.001 | Intentionally Weakening Network Security Controls For a Third Party | The subject intentionally weakens or bypasses network security controls for a third party, such as providing credentials or disabling security controls. |
| PR003.002 | Installing VPN Applications | A subject installs a VPN application that allows them to tunnel their traffic. |
| ME003.002 | VPN Applications | A subject has access to a VPN application. |