Azure AD Account Authentication from Multiple IPs

This analytic identifies suspicious Azure Active Directory (AD) account activity characterized by successful authentications originating from multiple distinct IP addresses within a short time frame (30 minutes). This behavior is detected by analyzing Azure AD SignInLogs. This activity can indicate that an attacker has gained unauthorized access to an account, potentially through credential compromise following a phishing campaign or other means. Successful exploitation can lead to unauthorized access to sensitive data, internal systems, and further malicious activities within the Azure AD environment.

Attack Chain

1. An attacker gains access to valid Azure AD credentials through phishing, credential stuffing, or other means (T1110, T1566).
2. The attacker attempts to authenticate to Azure AD using the compromised credentials.
3. The legitimate user may also authenticate normally from their usual location.
4. The attacker successfully authenticates from a different IP address than the legitimate user.
5. Azure AD SignInLogs record successful authentication events, including the source IP address (src), user, and other relevant details.
6. A security monitoring system detects multiple successful authentications from different IP addresses for the same user within a 30-minute window.
7. The attacker leverages the compromised account to access cloud resources, applications, and data within the Azure environment.

Impact

Successful exploitation of compromised Azure AD accounts can lead to significant damage. This includes unauthorized access to sensitive data stored within cloud applications, potential data breaches, and the ability for attackers to move laterally within the Azure environment. Affected organizations may experience financial losses, reputational damage, and legal liabilities.

Recommendation

• Deploy the Sigma rule Azure AD Successful Authentication From Different IPs to your SIEM and tune the threshold for unique_ips based on your environment to reduce false positives.
• Investigate any alerts generated by the Sigma rule to determine if the user account has been compromised.
• Implement multi-factor authentication (MFA) to mitigate the risk of credential compromise.
• Monitor Azure AD SignInLogs for unusual authentication patterns, such as logins from unfamiliar locations or devices.