Agent Foskett Academy • SOC Analyst Academy • Module 10 • Lesson 93 • Complete SOC Investigation Scenarios

Lesson 93 — The Identity Incident Reached the Endpoint

The account was compromised.

Then a device appeared in the timeline.

PowerShell ran minutes later.

The incident had moved again.

When identity activity reaches a device, follow the account into endpoint telemetry.

Follow the Endpoint Back to SOC Analyst Academy

Agent Foskett correlating identity compromise with endpoint activity

The account is only one part of the story.

Correlate identity evidence with device, process and network activity.

✓ Identity

✓ Device

✓ Process

✓ Network

Case briefing

08:36 Phishing link clicked 08:40 Suspicious sign-in 08:45 Successful access 08:57 Account appears on WS-214 09:01 PowerShell launched 09:03 External connection DID THE IDENTITY COMPROMISE REACH THE ENDPOINT?

Investigation objective

Correlate a suspected identity compromise with endpoint telemetry and determine whether the attacker used the compromised identity to establish activity on a device.

Investigator's rule

When the identity touches a device, pivot on both the account and the device.

Stage 1 — identify the endpoint pivot

Identity evidence	Endpoint question
Compromised account	Which devices show activity for this identity?
Successful sign-in	Did device activity begin shortly afterwards?
Suspicious IP	Does related infrastructure appear in endpoint telemetry?
New application access	Was a device or remote workflow involved?

Do not wait for another alert

The absence of an endpoint alert does not mean the endpoint is clean. The identity timeline itself may justify the pivot.

Use the account as a bridge

The same identity appearing in authentication and endpoint activity can connect two security domains into one incident.

Stage 2 — find the account on devices

123456789101112

let User = "alex@contoso.com";
DeviceProcessEvents
| where Timestamp > ago(4h)
| where AccountUpn =~ User
| project Timestamp,
          DeviceId,
          DeviceName,
          AccountUpn,
          InitiatingProcessFileName,
          FileName,
          ProcessCommandLine
| order by Timestamp asc

Build the device list

Identify every endpoint associated with the identity during the incident window before focusing only on the first suspicious device.

Time proximity matters

Activity beginning shortly after suspicious authentication strengthens the relationship, but timing alone is not proof. Validate the process and user context.

Stage 3 — reconstruct execution

08:57 ACCOUNT ON WS-214 09:00 BROWSER PROCESS 09:01 POWERSHELL 09:01 UNUSUAL COMMAND LINE 09:03 OUTBOUND CONNECTION IDENTITY ↓ DEVICE ↓ PROCESS ↓ NETWORK

Process ancestry matters

A process name in isolation can mislead. The initiating process, command line and follow-on activity help determine whether execution fits normal behaviour.

Do not stop at PowerShell

PowerShell is a tool. Its ancestry, arguments, user context and subsequent behaviour determine whether it supports the compromise hypothesis.

Stage 4 — inspect the process chain

123456789101112

let Device = "WS-214";
DeviceProcessEvents
| where Timestamp > ago(4h)
| where DeviceName =~ Device
| project Timestamp,
          AccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          FileName,
          ProcessCommandLine,
          SHA1
| order by Timestamp asc

Look before and after

The process that caught your attention may sit in the middle of the attack chain. Review its parent and follow-on processes.

Preserve the sequence

The exact order of process creation can explain how execution began and which behaviour should become your next pivot.

Stage 5 — correlate network activity

123456789101112

let Device = "WS-214";
DeviceNetworkEvents
| where Timestamp > ago(4h)
| where DeviceName =~ Device
| project Timestamp,
          DeviceName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          RemoteIP,
          RemoteUrl,
          RemotePort
| order by Timestamp asc

Sequence strengthens the story

Suspicious execution followed immediately by unusual outbound communication is more meaningful than either observation considered independently.

Compare infrastructure

Check whether endpoint destinations relate to infrastructure already observed during the phishing or identity stages.

Stage 6 — combine the timeline

PHISHING CLICK ↓ SUSPICIOUS SIGN-IN ↓ SUCCESSFUL ACCESS ↓ ACCOUNT ON WS-214 ↓ POWERSHELL ↓ EXTERNAL CONNECTION ONE INCIDENT EMAIL + IDENTITY + ENDPOINT

The timeline is the incident

Security products may present separate alerts, but your investigation should describe the connected sequence of attacker activity.

Independent telemetry adds confidence

Email, identity and endpoint evidence supporting the same hypothesis makes the overall incident story stronger.

Stage 7 — determine endpoint scope

Scope question	Pivot
Did the account appear on other devices?	Search endpoint activity by identity
Did the same command run elsewhere?	Search command-line patterns
Did the same hash appear elsewhere?	Search process and file telemetry
Did other devices contact the same destination?	Search network telemetry
Was persistence created?	Review tasks, services and startup activity

One device may not be the scope

Once malicious endpoint behaviour is confirmed, search for the same behavioural and technical evidence elsewhere.

Search behaviour as well as indicators

Hashes and IP addresses can change. The execution technique may reveal related activity that indicator-only searches miss.

Stage 8 — containment expands too

COMPROMISED IDENTITY + SUSPICIOUS PROCESS CHAIN + OUTBOUND CONNECTION NOW CONSIDER: REVOKE SESSIONS RESET CREDENTIALS ISOLATE DEVICE PRESERVE EVIDENCE SCOPE OTHER DEVICES ADDRESS BOTH IDENTITY AND ENDPOINT.

Contain both sides

Identity actions may be required alongside endpoint isolation. Addressing only one side can leave another path available to the attacker.

Preserve evidence first where possible

Capture telemetry and artefacts needed to understand execution, persistence and scope before destructive remediation changes them.

Stage 9 — incident finding

FINDING The phishing-linked identity compromise progressed to endpoint activity on WS-214. The compromised account appeared on the device shortly after suspicious successful access. PowerShell then executed with an unusual command line and was followed by outbound activity. SCOPE: Email Identity Endpoint NEXT: Contain identity and device. Preserve evidence. Search other endpoints.

State what changed

The incident is no longer only an account compromise. Execution on an endpoint means scope and response must expand.

Do not overstate attribution

Describe the observed attack chain without claiming who operated it unless the evidence actually supports attribution.

Decision point

A Keep investigating only email B Reset password and close C Contain the identity, assess/isolate WS-214, and scope other endpoints D Wait for another alert BEST DECISION: C THE INCIDENT HAS EXPANDED.

Follow the current evidence

The investigation began with phishing, moved into identity and has now reached an endpoint. Response should follow the incident as it evolves.

The next question is movement

Once endpoint execution is established, determine whether the activity remained on that device or reached additional systems.

Lesson 93 key takeaways

Identity compromise can progress into endpoint activity without an immediate new alert.
Use the compromised identity as a pivot into device telemetry.
Identify all devices associated with the account during the incident window.
Reconstruct process ancestry rather than judging a process name alone.
Command-line and parent-child context help explain execution.
Correlate endpoint network activity with earlier incident evidence.
Build one timeline across email, identity and endpoint telemetry.
Search other devices for the same behaviour, command, hash and infrastructure.
Containment may require both identity and endpoint actions.
Preserve evidence before remediation where operationally possible.
Expand scope when the evidence expands.
After endpoint execution, investigate possible lateral movement.

Module 10 — Complete SOC Investigation Scenarios

Lesson 93 followed the compromised identity onto an endpoint and correlated authentication with process and network activity. Lesson 94 continues the incident when endpoint activity begins reaching additional devices.

Next: Lesson 94 — The Endpoint Incident Became Lateral Movement

Continue your SOC Analyst training

Module 9 focuses on turning validated investigation findings into transparent, tested and operationally useful detections.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 10: Complete SOC Investigation Scenarios

Apply the full SOC workflow across realistic multi-stage incidents, from triage and investigation through containment, handover and closure.

← Previous lesson

Lesson 92 — The Phishing Email Became an Identity Incident Follow one case across email and identity.

✅ Current lesson

Lesson 93 — The Identity Incident Reached the Endpoint Correlate compromise with process and device activity.

Next lesson →

Lesson 94 — The Endpoint Incident Became Lateral Movement Scope movement to additional devices.

How do you correlate identity compromise with endpoint activity?

Lesson 93 of the Agent Foskett SOC Analyst Academy follows a compromised identity onto an endpoint and correlates suspicious authentication with process execution, PowerShell activity and network connections.

Investigating identity-to-endpoint attack progression

Learn how to pivot from an account to device telemetry, reconstruct process chains, scope related endpoints, preserve evidence and decide when identity and endpoint containment must occur together.