Lesson 149 — The Account Logged On to Another Device Minutes Later

Case briefing

Stage 1 — follow the account through logon telemetry

Begin with the account and narrow incident window. Preserve destination device, logon type, result, remote source and initiating-process fields where they are available.

let TargetAccount = "alex.wilson";
let TargetTime = datetime(2026-08-18 01:31:00);
DeviceLogonEvents
| where Timestamp between (TargetTime - 10m .. TargetTime + 15m)
| where AccountName =~ TargetAccount
| project Timestamp,
          DeviceName,
          AccountName,
          AccountDomain,
          LogonType,
          ActionType,
          RemoteDeviceName,
          RemoteIP,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Stage 2 — isolate logons away from the original device

Now remove WS-FIN-042 from the result set and ask where else the account appeared during the surrounding period.

let TargetAccount = "alex.wilson";
let OriginalDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:31:00);
DeviceLogonEvents
| where Timestamp between (TargetTime - 15m .. TargetTime + 30m)
| where AccountName =~ TargetAccount
| where DeviceName !~ OriginalDevice
| project Timestamp,
          DeviceName,
          LogonType,
          ActionType,
          RemoteDeviceName,
          RemoteIP,
          InitiatingProcessFileName
| order by Timestamp asc

Stage 3 — investigate the destination device

Pivot to WS-HR-017 and examine the account's logon event in detail. The aim is to preserve enough context to decide whether the authentication resembles normal access or attacker movement.

let TargetDevice = "WS-HR-017";
let TargetAccount = "alex.wilson";
let TargetTime = datetime(2026-08-18 01:31:00);
DeviceLogonEvents
| where DeviceName =~ TargetDevice
| where AccountName =~ TargetAccount
| where Timestamp between (TargetTime - 10m .. TargetTime + 20m)
| project Timestamp,
          DeviceName,
          AccountName,
          LogonType,
          ActionType,
          RemoteDeviceName,
          RemoteIP,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Stage 4 — establish the account's normal device pattern

Expand to seven days and summarise the devices, logon types and remote IPs associated with the account. This gives the second-device event behavioural context.

let TargetAccount = "alex.wilson";
DeviceLogonEvents
| where Timestamp > ago(7d)
| where AccountName =~ TargetAccount
| summarize FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Logons=count(),
            Devices=dcount(DeviceId),
            DeviceNames=make_set(DeviceName, 50),
            LogonTypes=make_set(LogonType, 20),
            RemoteIPs=make_set(RemoteIP, 50)
          by AccountName
| order by FirstSeen asc

Stage 5 — build the account movement timeline

Place the account's endpoint logons in chronological order around the incident. The temporal relationship to the earlier LSASS-related evidence is now one of the central clues.

let TargetAccount = "alex.wilson";
let StartTime = datetime(2026-08-18 01:22:00);
let EndTime = datetime(2026-08-18 01:40:00);
DeviceLogonEvents
| where Timestamp between (StartTime .. EndTime)
| where AccountName =~ TargetAccount
| project Timestamp,
          DeviceName,
          AccountName,
          LogonType,
          ActionType,
          RemoteDeviceName,
          RemoteIP,
          InitiatingProcessFileName
| order by Timestamp asc

Agent Foskett's lateral-movement timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR endpoint logon telemetry recorded a successful authentication by alex.wilson to WS-HR-017 approximately four minutes after LSASS-related security evidence was observed on the compromised device WS-FIN-042. The destination device, logon type and available remote-source context were reviewed and compared with the account's recent endpoint authentication history. WS-HR-017 was not present in the recent device baseline, increasing the significance of the event. In the context of the preceding execution, persistence and credential-access evidence, the authentication supports a possible lateral-movement hypothesis. Activity on WS-HR-017 should be investigated as a new endpoint timeline before concluding that lateral movement was successful.

Lesson 149 key takeaways

• DeviceLogonEvents can help follow an account across Defender-onboarded endpoints.
• Preserve destination device, LogonType, result and available remote-source context.
• A successful logon proves authentication succeeded, not that the legitimate user performed it.
• Compare the destination with the account's recent device baseline.
• A new device is supporting evidence, not proof of lateral movement.
• Known devices can also be abused by an attacker.
• Do not invent source information when telemetry fields are empty.
• Timing becomes especially important after suspected credential-access activity.
• A suspicious second-device logon turns the destination endpoint into a new investigation pivot.
• Correlate authentication with process, file, network and identity evidence before reaching a final conclusion.

Module 12 — one investigation remains

Lesson 148 identified possible credential-access behaviour. Lesson 149 now follows the account onto another endpoint and raises the possibility of lateral movement. In the final lesson of Module 12, we bring every stage together and decide what the evidence can defend.