cyber-detecting-anomalous-authentication-patterns

name	cyber-detecting-anomalous-authentication-patterns
description	Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in inve
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: detecting-anomalous-authentication-patterns | description: 'Detects anomalous authentication patterns using UEBA analytics, statistical | baselines, and machine learning models to identify impossible travel, credential | stuffing, brute force, password spraying, and compromised account behaviors across | authentication logs. Activates for requests involving authentication anomaly detection, | login behavior analysis, UEBA implementation, or suspicious sign-in investigation. | |
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Detecting Anomalous Authentication Patterns

When to Use

• Security operations needs to identify compromised accounts from authentication log analysis
• Implementing impossible travel detection to flag geographically inconsistent logins
• Detecting brute force, password spraying, and credential stuffing attacks in real time
• Building behavioral baselines for users to identify deviations indicating account compromise
• Correlating authentication anomalies with threat intelligence for lateral movement detection
• Investigating alerts from SIEM or IdP for suspicious sign-in activity

Do not use for static rule-based alerting on single failed logins; anomaly detection requires statistical baselines across time and entity dimensions to reduce false positives.

Prerequisites

• Authentication log sources (Azure AD/Entra ID sign-in logs, Okta system logs, Active Directory event logs 4624/4625/4648/4768/4771)
• SIEM platform (Splunk, Microsoft Sentinel, Elastic SIEM) with at least 90 days of baseline data
• GeoIP database for location-based anomaly detection (MaxMind GeoLite2 or IP2Location)
• Python 3.9+ with pandas, scikit-learn, and scipy for custom analytics
• User identity context (department, role, typical work hours, location)

Workflow

Step 1: Collect and Normalize Authentication Logs

Aggregate authentication events from all identity sources:

import pandas as pd
import json
from datetime import datetime, timedelta
from collections import defaultdict

# Parse authentication logs from multiple sources
def normalize_auth_logs(log_source, raw_logs):
    """Normalize authentication events to a common schema."""
    normalized = []

    for event in raw_logs:
        if log_source == "azure_ad":
            normalized.append({
                : event[],
                : event[],
                : event[],
                : {
                    : event.get(, {}).get(),
                    : event.get(, {}).get(),
                    : event.get(, {}).get(),
                    : event.get(, {}).get(, {}).get(),
                    : event.get(, {}).get(, {}).get()
                },
                :   event[][] ==   ,
                : event[].get(, ),
                : event.get(, ),
                : event.get(, {}).get(, ),
                : event.get(, {}).get(, ),
                : event.get(, [{}])[].get(, ),
                : event.get(, ),
                : event.get(, ),
                : 
            })
         log_source == :
            normalized.append({
                : event[],
                : event[][],
                : event[][],
                : {
                    : event[].get(, {}).get(),
                    : event[].get(, {}).get(),
                    : event[].get(, {}).get(),
                    : event[].get(, {}).get(, {}).get(),
                    : event[].get(, {}).get(, {}).get()
                },
                :   event[][] ==   ,
                : event[].get(, ),
                : event.get(, [{}])[].get(, ),
                : event[].get(, ),
                : event[].get(, {}).get(, ),
                : 
            })
         log_source == :
            normalized.append({
                : event[],
                : event[],
                : event.get(, ),
                : ,  
                :   event[]  [, ]  ,
                : event.get(, ),
                : event.get(, ),
                : 
            })

     pd.DataFrame(normalized)


 geoip2.database

 ():
    
    reader = geoip2.database.Reader(geoip_db_path)

     idx, row  df.iterrows():
         row[]    row[]:
            :
                response = reader.city(row[])
                df.at[idx, ] = {
                    : response.city.name,
                    : response.country.iso_code,
                    : response.location.latitude,
                    : response.location.longitude
                }
             Exception:
                

    reader.close()
     df