Sign-in many source IPs
One account authenticating successfully from an unusually large number of DISTINCT source IPs in a short window - a strong account-takeover /…
What it detects
One account authenticating successfully from an unusually large number of DISTINCT source IPs in a short window - a strong account-takeover / token-replay signal (many footholds, or a session cookie replayed from a botnet). This is the authoritative-rule form of the non-authoritative affected-users analytics: when the analyst wants an alert, not just an insight.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Corporate VPNs, mobile carriers, and cloud egress can spread one user across several IPs. Weigh the /16 spread, geo distance, and whether the IPs are known egress ranges before escalating; tune count to the tenant's normal footprint.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/signin_many_source_ips.yaml, licensed under the Apache License 2.0.
id: cloud.identity.signin_many_source_ips
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1078]
description: |
One account authenticating successfully from an unusually large number of DISTINCT
source IPs in a short window - a strong account-takeover / token-replay signal (many
footholds, or a session cookie replayed from a botnet). This is the authoritative-rule
form of the non-authoritative affected-users analytics (ADR-004 / ADR-023 Phase A): when
the analyst wants an alert, not just an insight.
match:
platform: application
event_category: authentication
event_outcome: success
threshold:
distinct: source_ip
count: 8
window_seconds: 3600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Corporate VPNs, mobile carriers, and cloud egress can spread one user across several
IPs. Weigh the /16 spread, geo distance, and whether the IPs are known egress ranges
before escalating; tune count to the tenant's normal footprint.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.