LoFP
/
T1098.005
T1098.005
Title
Tags
false positives may be generated by normal provisioning workflows for user device registration.
t1078
T1098.005
t1110
t1556.006
t1621
identity
splunk
false positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration.
T1098.005
t1556.006
t1621
identity
splunk
false positives may be generated by users working out the geographic region where the organizations services or technology is hosted.
T1098.005
t1556.006
t1621
identity
splunk
it is possible that the user has legitimately added a new device to their account. please verify this activity.
t1098
T1098.005
okta tenant
splunk
users may register mfa methods legitimally, investigate and filter as needed.
t1098
T1098.005
o365 tenant
azure tenant
splunk