ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • Microsoft Entra ID • Password Spray • SigninLogs • Source IP • Identity Correlation • Sentinel • KQL

One IP Address Authenticated to Seven Accounts in Nine Minutes

The first alert belonged to one user.

A successful sign-in had appeared from an unfamiliar IP address.

It would have been easy to investigate that account, reset the password and close the incident.

Agent Foskett searched the IP address instead.

Seven different accounts had authenticated from it in nine minutes.

Discuss identity security Back to investigations
Agent Foskett investigating one IP address authenticating to multiple Microsoft Entra accounts
Pivot On The Infrastructure

Sometimes the user is only the first clue. The source IP can reveal how many identities belong to the same incident.

Start with the suspicious successful sign-in
Pivot from user to source IP
Find every account the infrastructure touched

The first sign-in did not look like a tenant-wide incident

One user had authenticated successfully from an IP address the analyst did not recognise. There was no ransomware alert, no malware family and no obvious reason to believe several identities were involved. The investigation changed only when the analyst stopped asking what happened to the user and started asking what else the IP address had touched.
One user created the leadThe suspicious sign-in gave the investigation its first entity: an account.
The IP created the pivotInstead of treating the source address as background context, Agent Foskett used it as the next investigation key.
The incident suddenly became widerMultiple identities connected to the same source within minutes changed the question from account compromise to possible campaign activity.

Start with the successful sign-in

Use Microsoft Entra sign-in telemetry to establish the account, source IP, application, device context and Conditional Access result. This query gives the analyst the initial event that triggered the investigation.
initial-suspicious-signin.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
let User = "alex@contoso.com";
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ User
| where ResultType == 0
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          AppDisplayName,
          ClientAppUsed,
          ConditionalAccessStatus,
          DeviceDetail,
          LocationDetails
| order by TimeGenerated desc

Now reverse the investigation

Once the suspicious IP address is known, stop filtering on the original user. Search the same time window for every identity associated with that source. This is the point where a single-account investigation can become a tenant-wide incident.
pivot-on-source-ip.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
let SuspiciousIP = "203.0.113.44";
SigninLogs
| where TimeGenerated > ago(24h)
| where IPAddress == SuspiciousIP
| project TimeGenerated,
          UserPrincipalName,
          ResultType,
          ResultDescription,
          AppDisplayName,
          ClientAppUsed,
          ConditionalAccessStatus,
          DeviceDetail
| order by TimeGenerated asc

Seven accounts appeared in nine minutes

The pattern mattered more than any individual row. Several different accounts were touched by the same source in a tight time window. Some attempts failed. Others succeeded. That combination can be consistent with password spraying, credential stuffing, reused passwords or other automated identity attacks, but the analyst still needs evidence before declaring the technique.
accounts-touched-by-ip.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
let SuspiciousIP = "203.0.113.44";
SigninLogs
| where TimeGenerated > ago(24h)
| where IPAddress == SuspiciousIP
| summarize Attempts = count(),
            Successful = countif(ResultType == 0),
            Failed = countif(ResultType != 0),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by UserPrincipalName
| order by FirstSeen asc

Measure the behaviour, not just the count

A corporate proxy, VPN concentrator, mobile carrier or trusted service can legitimately place many users behind one public IP address. Context matters. Look at timing, applications, failures, successful authentications, geography, device information and whether the source is expected in your environment.
Shared IP does not equal attackerNAT, VPNs and cloud services can make legitimate users appear behind the same address.
The sequence mattersA tight pattern of authentication attempts across unrelated accounts can be far more informative than the IP address alone.
Success changes the priorityFailed password spray attempts matter. A successful authentication among them means the investigation has potentially moved from attempted attack to compromise.

Find IPs touching many identities

This hunting query looks for source IP addresses associated with multiple distinct users over a short period. It is deliberately a hunting starting point rather than a detection verdict because shared infrastructure can generate legitimate matches.
multi-account-ip-hunt.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
SigninLogs
| where TimeGenerated > ago(24h)
| summarize Users = dcount(UserPrincipalName),
            UserList = make_set(UserPrincipalName, 50),
            Attempts = count(),
            Successful = countif(ResultType == 0),
            Failed = countif(ResultType != 0),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by IPAddress, bin(TimeGenerated, 15m)
| where Users >= 5
| order by Users desc

The successful accounts become new investigation branches

Once an IP has touched several accounts, identify which authentications succeeded and investigate those identities separately. Review MFA, Conditional Access, device context, applications, subsequent cloud activity and any changes made after sign-in. The IP finds the cluster; the account timelines determine the impact.
Check authentication strengthWas MFA required? Was it satisfied? Was the authentication method expected for that user?
Follow post-sign-in activityLook for mailbox access, SharePoint activity, new MFA methods, OAuth consent, role changes and other actions following successful authentication.
Contain the whole incidentResetting the first account is not enough if the same infrastructure has already reached six others.

Agent Foskett's investigation mindset

Entities are doors into the investigation. A user can lead to an IP. An IP can lead to seven users. Those users can lead to applications, devices, sessions and cloud activity.
Never investigate an entity in isolationThe value of an IP address is not simply whether it looks suspicious. Its value is everything else it connects.
Reverse the queryIf you found the IP through the user, search for users through the IP. This simple reversal often exposes the wider attack.
Scope before closureBefore closing an identity incident, establish whether the same infrastructure, device or application touched anything else.

Investigation findings

The original account was only the first visible part of the incident. Pivoting on the source IP exposed authentication activity across seven identities within nine minutes. The investigation then separated failed attempts from successful sign-ins, reviewed environmental context and expanded containment to every account that may have been affected.
The first user was not the incidentThey were the clue that exposed a wider authentication pattern.
The IP connected the evidenceOne infrastructure pivot transformed seven apparently separate authentication events into a single investigation hypothesis.
The successful sign-ins defined the riskFailures showed attempted access. Successful authentication identified the accounts that demanded immediate impact analysis and containment.

Related Agent Foskett investigations

Continue with Microsoft Entra sign-in analysis, MFA compromise and identity correlation investigations.
The New MFA Method Was Registered 11 Minutes After the LoginFollow a suspicious sign-in into an authentication-method change that alters the compromise story.
The Conditional Access Result Said Success — But That Wasn't the Whole StoryInvestigate why a successful Conditional Access result still needs context.
Agent Foskett AcademyBuild practical Microsoft security investigation and KQL skills through structured lessons.
The user was the clue. The IP was the investigation.
When one entity looks suspicious, ask what else it connects to.
Visit the Agent Foskett Academy

Final thought

The easiest investigation would have followed one user. The better investigation followed the relationship between the user and the source IP. That single pivot exposed six additional accounts and changed the scope of the incident. In security operations, the most important question is often not “what happened to this account?” but “what else touched the same evidence?”
Start with the userEstablish why the original authentication deserves attention.
Pivot on the IPSearch across the tenant instead of remaining trapped inside one user's timeline.
Scope the whole attackBecause seven accounts in nine minutes is not seven investigations. It may be one incident.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

One IP Address Authenticated to Seven Accounts in Nine Minutes

This Agent Foskett investigation explores Microsoft Entra identity attacks, source-IP correlation, password spraying, credential attacks and why analysts should pivot from a suspicious user to every other account touched by the same infrastructure.

Microsoft Entra SigninLogs And KQL Identity Correlation

The investigation uses SigninLogs in Microsoft Sentinel to review successful and failed authentication attempts, source IP addresses, applications, Conditional Access context and distinct user accounts associated with the same infrastructure.

Password Spray Investigation And Identity Threat Hunting

GEMXIT helps organisations investigate suspicious Microsoft Entra authentication using Defender XDR, Sentinel and KQL to identify multi-account attack patterns, correlate identities and scope potential compromise before an incident is closed.