What does the ARO: User Authentication Detected mean?

Introduction

Threat actors frequently use VPN/VPS providers to mask their location when attempting to breach your threat surface. They often use a VPN or VPS to launch phishing campaigns that collect login credentials, or to run brute force login attempts. Once they obtain credentials, they use a VPN/VPS to breach your threat surface.

Field Effect maintains its own database of suspicious VPN/VPS IPs incorporating detections from the Field Effect solution as well as external resources such as ip2location.com.

Authentication attempts made from suspicious IPS may be an indication of an account compromise, especially if you can't attribute the activity to the intended user. This alert tells you which account connected to which service, where the connection came from, and which VPN/VPS service it used.

If the flagged user recognizes the activity, you can dismiss the ARO to prevent further reporting. However, if the user doesn't recognize the activity, we recommend changing the affected account's credentials and ensuring MFA is enabled.

We also recommend confirming with the user if they received such and email. If such an email exists please submit the email to our Suspicious Email Analysis Service (SEAS).

You can also use resources such as https://abuseipdb.com to check the reputation of the IP and see whether threat actors have used it as the source of a phishing campaign that may have targeted the user.