PingID Mismatch Auth Source and Verification Response

name: PingID Mismatch Auth Source and Verification Response
id: 15b0694e-caa2-4009-8d83-a1f98b86d086
version: 7
date: '2026-03-10'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
data_source:
    - PingID
search: "`pingid` (\"result.status\" IN (\"SUCCESS*\",\"FAIL*\",\"UNSUCCESSFUL*\" ) NOT \"result.message\" IN (\"*pair*\",\"*create*\",\"*delete*\")) | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', object = 'resources{}.devicemodel', status = 'result.status' | join user session_id [ search `pingid` (\"result.status\" IN (\"POLICY\") AND \"resources{}.ipaddress\"=*) AND \"result.message\" IN(\"*Action: Authenticate*\",\"*Action: Approve*\",\"*Action: Allowed*\") | rex field=result.message \"IP Address: (?:N\\/A)?(?<policy_ipaddress>.+)?\\n\" | rex field=result.message \"Action: (?:N\\/A)?(?<signature>.+)?\\n\" | rex field=result.message \"Requested Application Name: (?:N\\/A)?(?<Requested_Application_Name>.+)?\\n\" | rex field=result.message \" Requested Application ID: (?:N\\/A)?(?<Requested_Application_ID>.+)?\\n\" | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) | fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest | iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`"
how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by users working out the geographic region where the organizations services or technology is hosted.
references:
    - https://twitter.com/jhencinski/status/1618660062352007174
    - https://attack.mitre.org/techniques/T1098/005/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
drilldown_searches:
    - name: View the detection results for - "$user$" and "$src$"
      search: '%original_detection_search% | search  user = "$user$" src = "$src$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$" and "$src$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: An authentication by [$user$] was detected from [$dest$ - $auth_Country$] and the verification was received from [$src$ - $verify_Country$].
    risk_objects:
        - field: user
          type: user
          score: 50
        - field: src
          type: system
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - Compromised User Account
    asset_type: Identity
    mitre_attack_id:
        - T1621
        - T1556.006
        - T1098.005
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: access
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid.log
          source: PINGID
          sourcetype: _json