Concurrent Login by Same User
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Triggers when a single user account logs in from multiple IP addresses within a short timeframe. This behavior indicates potential credential sharing, compromised credentials, or unauthorized access attempts.
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Authentication Events" AND (OPERATION_TYPE = "userAuthenticate")
| timewindow 5m
| groupby USERID having DCOUNT(IPADDRESS) >= 2
select Action1.timewindow.USERID,Action1.timewindow.IPADDRESS,Action1.timewindow.USERNAME,Action1.timewindow.STATUS
Detection
Log Sources
CrowdStrike Falcon
