Lesson 137 — The Sign-In Was Successful but the Session Wasn't Normal

The investigation begins

Step 1 — anchor the investigation on the successful sign-in

Start in SigninLogs. Capture the successful event's time, source, application, resource, device and access-control context. This gives us the doorway into the session.

let TargetUser = "alex.wilson@contoso.com";
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ TargetUser
| where ResultType == "0"
| project TimeGenerated,
          UserPrincipalName,
          AppDisplayName,
          ResourceDisplayName,
          IPAddress,
          Location,
          ClientAppUsed,
          ConditionalAccessStatus,
          AuthenticationRequirement,
          DeviceDetail,
          CorrelationId
| order by TimeGenerated desc

Step 2 — move into CloudAppEvents

CloudAppEvents contains activity involving accounts and objects in Office 365 and other cloud applications connected through Microsoft Defender for Cloud Apps. Use it to see what the identity did after authentication.

let TargetUser = "alex.wilson@contoso.com";
CloudAppEvents
| where Timestamp > ago(24h)
| where AccountId =~ TargetUser
       or AccountDisplayName =~ TargetUser
| project Timestamp,
          Application,
          ActionType,
          ActivityType,
          ObjectName,
          ObjectType,
          IPAddress,
          CountryCode,
          City,
          UserAgent
| order by Timestamp asc

Step 3 — establish the user's normal application and action profile

A session becomes interesting when its actions differ from what the user normally does. Summarize the last seven days by application and action type.

let TargetUser = "alex.wilson@contoso.com";
CloudAppEvents
| where Timestamp > ago(7d)
| where AccountId =~ TargetUser
       or AccountDisplayName =~ TargetUser
| summarize ActivityCount=count(),
            FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp)
          by Application, ActionType
| order by ActivityCount desc

Step 4 — use uncommon-user enrichment

Microsoft Defender for Cloud Apps can enrich events with UncommonForUser and LastSeenForUser. These fields can help identify attributes that are unusual for the account.

let TargetUser = "alex.wilson@contoso.com";
CloudAppEvents
| where Timestamp > ago(7d)
| where AccountId =~ TargetUser
       or AccountDisplayName =~ TargetUser
| where tostring(UncommonForUser) != ""
| project Timestamp,
          Application,
          ActionType,
          IPAddress,
          CountryCode,
          City,
          UncommonForUser,
          LastSeenForUser
| order by Timestamp desc

Step 5 — look for bursts of post-authentication activity

Attackers often move quickly once they have access. Group cloud activity into short windows and count both the volume and variety of actions.

let TargetUser = "alex.wilson@contoso.com";
CloudAppEvents
| where Timestamp > ago(24h)
| where AccountId =~ TargetUser
       or AccountDisplayName =~ TargetUser
| summarize ActivityCount=count(),
            ActionCount=dcount(ActionType),
            Apps=make_set(Application, 20),
            Actions=make_set(ActionType, 30),
            Countries=make_set(CountryCode, 10)
          by bin(Timestamp, 15m), IPAddress
| order by Timestamp asc

Step 6 — build the post-authentication timeline

Now lay the cloud activity out chronologically and keep the network, user-agent and anomaly-enrichment fields beside each action.

let TargetUser = "alex.wilson@contoso.com";
CloudAppEvents
| where Timestamp > ago(24h)
| where AccountId =~ TargetUser
       or AccountDisplayName =~ TargetUser
| project Timestamp,
          Application,
          ActionType,
          ActivityType,
          ObjectName,
          ObjectType,
          IPAddress,
          CountryCode,
          City,
          Isp,
          UserAgent,
          IsAdminOperation,
          IsAnonymousProxy,
          UncommonForUser,
          LastSeenForUser
| order by Timestamp asc

Evidence table

Agent Foskett's investigation

Investigation questions to ask next

• What exact cloud actions occurred after the sign-in?
• Were those actions normal for this user and application?
• Did the account touch unusual files, folders or other objects?
• Were any activities marked uncommon for the user?
• Did the IP address, country, ISP or user agent change after authentication?
• Did the session perform administrative operations?
• Did activity volume or action diversity suddenly increase?
• Were sharing, download, mailbox or permission changes involved?
• Did the same session affect other identities or resources?
• Should sessions be revoked while the investigation continues?

Lesson 137 key takeaways

• A successful sign-in is the beginning of a session, not the end of an investigation.
• Use SigninLogs to anchor the authentication context.
• Use CloudAppEvents to investigate post-authentication cloud behaviour where available.
• Cloud application activity should be compared with the user's own baseline.
• Familiar applications can still contain abnormal actions.
• UncommonForUser and LastSeenForUser can accelerate anomaly investigation.
• Short bursts and diverse actions can reveal suspicious session behaviour.
• Network and user-agent continuity help test whether the session remains consistent.
• CloudAppEvents availability depends on Defender for Cloud Apps and connected activity sources.
• The most useful question after successful authentication is often: what happened next?