Lesson 38 — The Account Logged On to Another Device Minutes Later
The investigation had reached a dangerous point.
The suspicious process had executed, contacted an external IP, created persistence and then interacted unexpectedly with LSASS.
Three minutes later, the affected account appeared on another workstation.
That did not prove lateral movement — but it created a new hypothesis the SOC could not ignore.
Agent Foskett now had to determine whether the second logon was normal user activity, an expected administrative connection, or evidence that the attacker had moved beyond the original endpoint.
The incident may have left the first device
Follow the account across endpoint logons, identify the source and destination, examine logon type and then investigate what happened on the second device.
Case briefing
Investigation objective
Determine whether the second-device logon represents expected user behaviour or possible lateral movement, identify the source and destination context, and investigate activity that followed on the new endpoint.
Investigator's rule
Movement is a sequence, not a single event. A logon becomes meaningful when you understand where it came from, how it authenticated and what happened next.
Stage 1 — follow the account across devices
let TargetAccount = "alex.wilson";
DeviceLogonEvents
| where Timestamp > ago(24h)
| where AccountName =~ TargetAccount
| project Timestamp,
DeviceName,
ActionType,
LogonType,
AccountDomain,
AccountName,
RemoteIP,
RemoteDeviceName
| order by Timestamp asc
Build the sequence first
Do not begin by deciding the second logon is malicious. Establish the account's normal and abnormal device activity around the incident window.
Time proximity matters
A new-device logon only minutes after suspicious credential-access activity deserves priority, but timing alone still does not establish causation.
Stage 2 — understand the logon context
| Evidence | Question for the analyst |
|---|---|
| LogonType | Was this interactive, remote, network-based or another expected authentication pattern? |
| RemoteIP | Did the connection originate from the compromised endpoint, a known management host or somewhere else? |
| RemoteDeviceName | Can the source endpoint be identified directly? |
| Destination device | Is the second device one the user normally accesses? |
| Timestamp | How closely does the logon follow the credential-access event? |
Do not overinterpret logon types
A logon type helps describe how authentication occurred, but it must be interpreted with source, destination and environmental context.
Remote IP can connect the devices
If the destination logon records an address associated with the original compromised endpoint, the lateral-movement hypothesis becomes stronger.
Stage 3 — investigate the destination device
let TargetDevice = "WS-HR-021";
let StartTime = datetime(2026-08-25 10:18:30);
let EndTime = datetime(2026-08-25 10:30:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (StartTime .. EndTime)
| project Timestamp,
AccountName,
FileName,
ProcessCommandLine,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
SHA1
| order by Timestamp asc
What happened after authentication?
Look for command shells, PowerShell, remote-management tools, service creation, discovery commands or other activity that would be unusual for the user.
The destination becomes part of the incident
If suspicious execution follows the new logon, preserve the second device's evidence and treat it as a new investigation pivot.
Stage 4 — correlate account and process activity
One timeline, two endpoints
The incident timeline now crosses device boundaries. Keep the timestamps in one chronological sequence rather than investigating each endpoint as an unrelated case.
Do not lose the identity pivot
The account connects the two devices. Continue following it while also examining endpoint evidence on both systems.
Stage 5 — search for unusual processes under the account
let TargetAccount = "alex.wilson";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName =~ TargetAccount
| project Timestamp,
DeviceName,
FileName,
ProcessCommandLine,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
SHA1
| order by Timestamp asc
Compare both devices
Repeated command lines, hashes or process patterns across the original and destination endpoints can provide strong correlation.
Normal user processes matter too
If the second device shows only expected interactive applications and the user routinely works there, that evidence may weaken the lateral-movement hypothesis.
Stage 6 — test competing explanations
| Hypothesis | Evidence to validate |
|---|---|
| Normal user movement | User confirmation, historical access to the destination device, expected logon type and normal applications. |
| Administrative activity | Approved support action, known management source, change record and expected tooling. |
| Automated service activity | Known service account behaviour, recurring pattern and expected destination. |
| Lateral movement | Compromised source device, suspicious credential access, unusual destination logon and follow-on execution. |
User confirmation is useful, not final
If the user says they did not access the second device, that is important evidence. Continue validating the technical record before documenting the conclusion.
Historical behaviour is powerful context
Check whether the account commonly logs on to the destination device. First-seen or rare device access can increase investigative priority.
Stage 7 — hunt for the account across the environment
let TargetAccount = "alex.wilson";
DeviceLogonEvents
| where Timestamp > ago(7d)
| where AccountName =~ TargetAccount
| summarize
Logons=count(),
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp)
by DeviceName, LogonType, RemoteIP
| order by LastSeen desc
Look beyond the second device
If credentials are being used for movement, there may already be a third or fourth endpoint involved. Scope the account before assuming the incident stops at WS-HR-021.
Preserve source and destination
For each suspicious logon, record the account, source, destination, timestamp and logon context so the movement path can be reconstructed later.
Stage 8 — make the SOC decision
Write the investigation finding
Lesson 38 key takeaways
- A second-device logon does not automatically prove lateral movement.
- Follow the affected account across DeviceLogonEvents.
- Record source, destination, timestamp and logon context.
- Interpret logon type together with environmental evidence.
- Investigate process activity on the destination device immediately after the logon.
- Keep one chronological timeline across multiple endpoints.
- Compare the new device with the user's historical behaviour.
- Use user statements as evidence but continue technical validation.
- Hunt the account across the wider environment to establish scope.
- Escalate when credential-access evidence and unexplained cross-device activity form a coherent attack sequence.
Module 4 — Endpoint Incidents: Following the Attack Chain
Lesson 38 follows the attack chain onto a second endpoint. Next, Agent Foskett reaches the operational decision point: the device needs containment — but what should happen before, during and after isolation?
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 4: Endpoint Incidents: Following the Attack Chain
How to investigate lateral movement in Microsoft Defender XDR
Lesson 38 of the Agent Foskett SOC Analyst Academy teaches analysts how to investigate an account logging on to another endpoint after suspicious credential-access activity, using DeviceLogonEvents and DeviceProcessEvents to reconstruct the movement path.
KQL lateral movement investigation for SOC analysts
Learn how to follow an account across endpoints, interpret source and destination context, investigate follow-on process activity and distinguish legitimate cross-device access from possible attacker movement.
