Incident ReportsIR
IR-2025-010
MED

Identity — Egypt VPN Sign-In (SLA Gap documented)

FILED:Dec 2025
TAXONOMY:T1078.004
Complexity:Standard
6d containment
~6m read
SUSPICIOUS ACTIVITY — SESSION REVOKED, PASSWORD RESET

Egyptian IP (TE Data / AS8452 — documented VPN exit) against a 100% London baseline with zero prior foreign activity. Probable VPN usage but escalated as caution due to complete baseline departure. Six-day client response delay is the primary operational finding of this case. Session revoked and forced password reset applied at closure.

IdentityEntraVPNConditional AccessM365
Outcome
Session revoked — all active access and refresh tokens invalidated
Forced password reset applied — credential reuse risk eliminated
No successful sign-ins during 6-day open window confirmed
6-day client response lag documented as primary finding for SLA review
Background & Context

TE Data (AS8452) is Egypt's largest internet service provider, offering residential, commercial, and data centre internet services. Its IP ranges are documented as VPN exit nodes for several commercial VPN services, making Egyptian TE Data IPs a common false-positive source in sign-in anomaly detection. The source IP returned an RF Score of 0 — no threat intelligence community has flagged it for malicious use, consistent with a clean ISP address used as a VPN exit.

Despite this context, the correct triage decision here is escalation as caution rather than silent closure. "Probably legitimate" is not "confirmed legitimate," and a 100% London baseline with zero prior foreign activity over 30 days makes any foreign IP a complete baseline departure — regardless of the IP's risk score. The baseline departure is the primary analytical signal; the RF Score 0 is contextual, not exculpatory.

The six-day client response time is the headline operational finding of this case. If Conditional Access had not been blocking the suspicious sign-in, a six-day window of potential account compromise while the client formulated their response would be operationally unacceptable. This incident is a direct argument for automated risk-based CA remediation policies that operate independently of analyst escalation and client response times.

Triage Thought Process
01RF Score 0 is not a safe signal. RF Score 0 means the IP has never appeared in threat intelligence feeds — not that it is clean. VPN exit nodes rotate frequently and are rarely reported.
02100% London baseline with zero prior foreign activity. Unlike IR-2025-009 where there were 5 prior Pakistani sign-ins, this user has never signed in from outside London in 30 days. Any foreign IP is a complete baseline departure.
03Probable VPN — but escalate regardless. 'Likely legitimate' is not 'confirmed legitimate'. A 100% baseline departure warrants escalation, not silent closure.
04Conditional Access is doing its job. The sign-in was blocked. But this is passive protection — active confirmation, session revocation, and password reset are still required.
05Automated follow-up is essential. Without 2-day and 7-day follow-up automation, this ticket could have been abandoned with no confirmed remediation.
06Retrospective risk window. During the 6-day open window, CA blocked the Egyptian IP — but a UK-based proxy would have bypassed it. Session revocation at day 6 was the definitive containment.
Decision
Escalate as caution. Probable VPN — but 100% baseline departure is sufficient. Session revocation and password reset are required outcomes. 6-day SLA lag is the primary operational finding.
Incident Timeline
02 Dec, ~12:30
Sign-in attempt from Egyptian IP — blocked by Conditional Access
02 Dec, ~12:34
Alert: Unfamiliar sign-in properties — Azure AD Identity Protection
02 Dec, ~14:50
Analyst begins triage — IP enriched: Egypt, Cairo — TE Data (AS8452), RF Score: 0
02 Dec, ~14:54
User 30-day baseline: 100% London ([CLIENT_IP] — 46 sign-ins) — complete baseline departure
02 Dec, ~14:54
Assessment: probable VPN — escalated as caution due to complete baseline departure
02 Dec, ~14:54
Escalation sent to client with context, risk assessment, and recommended actions
04 Dec, 15:25
Automation: 2-day no-response follow-up sent to client
07 Dec, 15:38
Automation: ticket marked for closure, second follow-up sent
08 Dec, 12:59
Client confirms: session revoked, forced password reset applied, user required to re-login
08 Dec, ~13:00
Ticket closed — remediation confirmed, 6-day SLA lag documented as finding
Technical Analysis

The user's 30-day sign-in baseline showed exclusively London-based activity: [CLIENT_IP] accounting for 46 combined sign-ins from two IP variants, all geolocating to Greater London. This represents a 100% UK-only baseline with no prior foreign activity of any kind — the cleanest possible baseline departure scenario.

The Conditional Access policies successfully blocked the sign-in at the time of detection. No corporate resources were accessed. The blocking mechanism functioned as designed and provided passive protection throughout the subsequent six-day period before client confirmation — but passive protection is not a substitute for active remediation.

TE Data (AS8452) is Egypt's largest telecommunications provider whose IP ranges appear in multiple commercial VPN provider exit node reports, suggesting the sign-in likely originated from a user routing traffic through an Egyptian VPN exit. However, VPN usage is not confirmed — it is assessed as probable. The analytical position is: probable VPN, but the correct action is the same regardless of root cause: escalate, seek confirmation, apply session revocation and password reset.

The two-day and seven-day automation follow-ups maintained escalation pressure during the non-response period. Without automated follow-up, this ticket could have remained unacknowledged indefinitely. The client's confirmed response — session revocation followed by forced password reset — represents the correct and conservative approach. Session revocation invalidates all active access and refresh tokens across all authenticated sessions. The forced password reset ensures the credential cannot be reused if it was exposed.

The KQL retrospective query reviewing all sign-in attempts during the six-day window is analytically important: it demonstrates that CA blocked all attempts during the open period, providing both reassurance and a compelling argument for why automated remediation policies would eliminate this class of response-lag risk.

Environment
Microsoft Sentinel — Azure AD Identity Protection
Microsoft 365 / Azure AD
Recorded Future (IP enrichment)
Signals
Unfamiliar sign-in properties alert — Azure AD Identity Protection
Source IP: Egypt, Cairo — TE Data (ASN: AS8452), RF Score: 0
Sign-in blocked by Conditional Access
User baseline: 100% London — zero prior foreign activity (46 sign-ins from two London IP variants)
What I Checked
IP enriched via Recorded Future: Egypt, Cairo — TE Data (AS8452), RF Score: 0 (clean but not conclusively benign)
30-day baseline: 100% London ([CLIENT_IP] — 46 sign-ins) — complete baseline departure confirmed
Assessed: probable VPN — TE Data documented as VPN exit infrastructure
Escalated as caution: 100% baseline departure warrants escalation regardless of RF Score
CA confirmed blocking throughout entire 6-day window — passive protection in place
Automated 2-day and 7-day follow-ups sent during client non-response period
Session revocation and forced password reset confirmed at closure
Actions Taken
Escalation sent with VPN probability assessment and recommended session revocation and password reset
Automated 2-day no-response follow-up sent (04 Dec, 15:25)
Automated 7-day closure follow-up sent (07 Dec, 15:38)
Client confirmed: session revoked, forced password reset applied, user required to re-login
6-day response lag formally documented as operational finding for service review
Indicators of Compromise
TypeIndicatorNotes
IP Address[REDACTED_IP]Egypt, Cairo — TE Data; RF Score: 0; documented VPN exit
GeolocationAfrica, Egypt, Cairo100% baseline departure — user history exclusively Greater London
ISP / VPN ExitTE DataEgyptian national ISP — ranges documented as VPN exit nodes
Baseline[CLIENT_IP] (Greater London)46 sign-ins from two London IP variants — consistent 100% UK-only pattern
Response Lag6 days from escalation to confirmed remediationPRIMARY FINDING — client SLA gap; to be raised formally at next service review
MITRE ATT&CK Mapping
TacticTechniqueIDObserved
Initial AccessValid Accounts: Cloud AccountsT1078.004Sign-in attempt with potentially valid credentials from foreign VPN exit infrastructure
Defense EvasionProxy / VPNT1090TE Data / VPN infrastructure used as exit — obscures true geographic origin
Detection Logic (KQL)
// Confirm full 30-day baseline and complete baseline departure
SigninLogs
| where UserPrincipalName == "[USER_UPN]"
| where TimeGenerated > ago(30d)
| summarize Count=count() by IPAddress, Location, CountryOrRegion
| order by Count desc

// Review all sign-in attempts during the 6-day open window
SigninLogs
| where UserPrincipalName == "[USER_UPN]"
| where TimeGenerated between (datetime(2025-12-02T12:34:00Z) .. datetime(2025-12-08T13:00:00Z))
| project TimeGenerated, IPAddress, Location, ResultType, ConditionalAccessStatus, AppDisplayName

// Verify no successful sign-ins slipped through CA during open window
SigninLogs
| where UserPrincipalName == "[USER_UPN]"
| where TimeGenerated > datetime(2025-12-02T12:34:00Z)
| where ResultType == 0
| project TimeGenerated, IPAddress, Location, AppDisplayName, ConditionalAccessStatus
Analyst NotesMuhammad Fezzan

The 6-day response time is the headline finding. If this had been a genuine credential compromise, the attacker would have had nearly a week to attempt further access — and Conditional Access was the only barrier.

The KQL retrospective query demonstrating CA-blocked attempts during the 6-day window is important — it's both reassuring and a compelling argument for why automated remediation policies would eliminate this class of response-lag risk.

RF Score 0 is not a benign signal — a 100% London baseline with zero prior foreign activity is significant regardless. Client SLA gap should be raised formally in the next service review.

Lessons Learned
RF Score 0 is not a benign signal — baseline departure was the primary indicator, not the IP risk score.
A 100% London baseline with zero prior foreign activity is significant regardless of RF score.
Six-day client response time is operationally unacceptable — define and enforce a 24-hour maximum SLA.
Automated follow-up is a critical safety net — without it, unacknowledged escalations may remain open indefinitely.
Implement risk-based automated session revocation via Azure AD Identity Protection CA.
Recommendations
R1Define and enforce client response SLAs for identity alerts: medium-severity identity alerts should receive a confirmed client response within 24 hours. A six-day window is operationally unacceptable for an active account security event. Formal SLA agreements and escalation paths for non-responsive clients must be established.
R2Implement risk-based automated session revocation: Azure AD Identity Protection risk-based Conditional Access should automatically block or require MFA re-authentication for medium/high sign-in risk events — supplementing analyst escalation with automated containment that operates independently of client response time.
R3Named location Conditional Access policy: block sign-ins from countries with no organisational presence or require step-up MFA, with an exception process for users with documented legitimate international access needs.
R4Clarify user VPN usage policy: if the user was using a personal VPN routing through Egypt, they should be advised to use the corporate VPN for all corporate resource access — creating a controlled, documented access pattern rather than an anomalous foreign baseline.
SIG
Case Certification
Muhammad Fezzan
SOC ANALYST
DIGITAL TIMESTAMP
DEC 2025 // REG-010-FS
← All incidentsCase anonymised