Lesson 4 — The User Said “I Didn’t Do That”

Case briefing

Stage 1 — record exactly what the user said

User conversations are part of the evidence trail. Write down the important facts without paraphrasing them into stronger claims than the user actually made.

Stage 2 — validate the sign-in with KQL

This is where KQL belongs in the SOC Academy. The lesson is not about learning the query language itself; KQL is simply the fastest way to test the user's statement against Microsoft Entra telemetry.

let TargetUser = "emily.h@contoso.com";
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ TargetUser
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          Location,
          AppDisplayName,
          ClientAppUsed,
          DeviceDetail,
          AuthenticationRequirement,
          ConditionalAccessStatus,
          ResultType
| order by TimeGenerated asc

Stage 3 — validate the endpoint activity

Now test the second part of the user's statement: “I haven’t used PowerShell today.” Use endpoint telemetry to identify exactly how PowerShell started and which account context was associated with the process.

let TargetDevice = "SALES-LT-018";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where FileName =~ "powershell.exe"
| project Timestamp,
          DeviceName,
          AccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          ProcessCommandLine,
          SHA1
| order by Timestamp asc

Stage 4 — compare competing explanations

Stage 5 — update the investigation with both sources

Your evidence board

Write the finding like an analyst

Example: The user stated that they did not recognise the successful sign-in or intentionally execute PowerShell on SALES-LT-018. The statement was recorded as supporting evidence and validated against Microsoft Entra sign-in and Defender for Endpoint telemetry. Investigation reviewed source IP, location, authentication context, device details, PowerShell process ancestry and command-line activity. The user's denial increases concern but does not independently establish compromise. Final disposition should be based on whether the technical evidence supports legitimate background activity, normal user behaviour or unauthorised access and execution.

Lesson 4 key takeaways

• A user statement is evidence, not a final disposition.
• Record what the user actually said without strengthening the wording.
• Ask neutral questions that do not embed your working theory.
• User memory and technical telemetry can legitimately differ.
• Use Entra sign-in telemetry to validate location, IP, device and authentication context.
• Use endpoint telemetry to determine how suspicious processes actually started.
• Process account context does not prove human attribution.
• Keep legitimate and malicious explanations alive until evidence separates them.
• KQL is a SOC investigation tool — not the purpose of the lesson.
• Write conclusions from the combined human and technical evidence.

Module 1 — inside the SOC

The user's statement has become part of the investigation, but the next challenge is deciding what evidence should be collected before the analyst starts forming a stronger conclusion.