Incident ReportsIR
IR-2025-009
MED

Identity — Foreign IPv6 Sign-In Blocked (Pakistan)

FILED:Nov 2025
TAXONOMY:T1110.001
Complexity:Analytically Complex
~6h containment
~5m read
TRUE POSITIVE — COMPROMISED CREDENTIAL / UNAUTHORISED ACCESS ATTEMPT

Sign-in attempt from a Pakistani IPv6 blocked by Conditional Access (Invalid Password). A partial prior Pakistani baseline complicated the analysis, but an independent AADUserRiskEventsTable flag drove the escalation decision. Account disabled. Post-incident, the user confirmed they were physically in the UK at the time — conclusively reclassifying this as a true positive: a malicious actor with compromised credentials. Prior Pakistani baseline events may themselves represent earlier credential testing.

IdentityEntraConditional AccessM365
Outcome
Account disabled — no access achieved, containment applied
Two-layer block confirmed: Conditional Access + Invalid Password
Post-incident user confirmation: true positive — malicious actor with compromised credentials, user was physically in UK
Background & Context

This incident is the most analytically complex identity alert in this portfolio. It introduces a scenario that tests the limits of baseline-based anomaly detection: a partial prior foreign baseline that partially legitimises the alert, combined with an independent risk signal that ultimately drives the correct escalation decision.

Azure AD Identity Protection's unfamiliar sign-in detection compares the current sign-in's seven properties against a 30-day rolling baseline. The complicating factor here is that the user's baseline contained 5 prior Pakistani sign-ins — meaning Pakistan was not a novel location. This required a more nuanced assessment than a clean foreign-IP scenario: the question was not simply "is this location unfamiliar?" but "is the specific IP novel, and are there independent risk signals that corroborate escalation?"

The Independent AADUserRiskEventsTable event — generated by Azure AD's ML model separately from the Sentinel alert — was the analytical tiebreaker. Two independent detection systems flagging the same account simultaneously is not a coincidence to dismiss. This principle — when baseline analysis is ambiguous, look for a second independent signal — is one of the most important lessons in this portfolio.

Triage Thought Process
01Start with the baseline. 77 Birmingham sign-ins and 5 prior Pakistani sign-ins. The 5 prior Pakistani events are a complicating factor — were those themselves anomalous?
02Separate two questions: Is the location novel? No — Pakistan appeared 5 times previously. Is the specific IP novel? Yes — the current IPv6 has not appeared in prior sign-ins.
03AADUserRiskEventsTable is the tiebreaker. A risky event was independently raised by Azure AD's ML model. Two independent systems flagging the same account simultaneously is not a coincidence to dismiss.
04Invalid Password is both reassuring and concerning. Reassuring: no access achieved. Concerning: may indicate stale credential from a prior breach, or credential stuffing.
05No registered device. Android not enrolled in Intune or Entra. Consistent with personal mobile and with attacker's Android device or emulator.
0605:55 UTC sign-in time. Early morning UK time, daytime Pakistan. Neither strongly confirms nor rules out either scenario without user confirmation.
Decision
Escalate as caution. Independent AADUserRiskEventsTable flag was the deciding factor over the ambiguous partial baseline. Confirmed true positive post-incident: user was in UK, Pakistani access was a malicious actor.
Incident Timeline
30 Nov, 05:55
Sign-in attempt: Pakistani IPv6 — blocked by Conditional Access (Invalid Password)
30 Nov, ~06:00
Alert: Unfamiliar sign-in properties — Azure AD Identity Protection (7 properties flagged)
01 Dec, ~11:20
Ticket assigned to analyst on day shift
01 Dec, ~11:21
Internal note drafted — all alert details and 30-day baseline logged
01 Dec, ~11:22
Escalation sent: sign-in details, ambiguity context, confirmation of expected activity requested
01 Dec, ~11:45
Client contact (Cyber Security Technician) responds: account disabled pending user confirmation
01 Dec, ~12:00
Ticket closed — account disabled as precautionary measure
Technical Analysis

The source IPv6 address [REDACTED_IPv6] falls in a prefix range associated with Pakistani internet infrastructure, geolocated to Karachi. Recorded Future enrichment returned an indeterminate score — the address is not catalogued in known threat feeds, which is expected for residential or mobile carrier IPv6 space in emerging markets.

The 30-day baseline presented genuine ambiguity: 77 sign-ins from Birmingham, UK ([CLIENT_IP]) alongside 5 sign-ins from the same Pakistani IPv6 range. The 5 prior Pakistani sign-ins suggest the user may have legitimate personal connections to Pakistan — however, the current alert was generated independently by Identity Protection and the specific IPv6 address was novel (not present in any of the 5 prior events).

The sign-in was blocked at two independent layers: Conditional Access (device or location compliance not met) and Invalid Password (the password provided was incorrect). The Invalid Password failure is analytically significant — it suggests the attacker either had a stale credential or was credential stuffing.

A risky event was recorded in the AADUserRiskEventsTable independently of the Sentinel alert. Two independent detection systems flagging the same account at the same time was the deciding factor for escalation over the ambiguous partial baseline.

Post-incident, the user confirmed they were physically in the UK at the time of the sign-in attempt. This conclusively reclassifies the incident as a true positive: the Pakistani IPv6 access was an unauthorised actor attempting to authenticate using compromised credentials. The prior 5 Pakistani sign-ins in the baseline may themselves represent earlier credential testing activity that was not independently flagged.

Environment
Microsoft Sentinel — Azure AD Identity Protection
Microsoft 365 / Azure AD
Recorded Future (IP enrichment)
Signals
Unfamiliar sign-in properties alert — 7 simultaneous properties flagged
Source: Pakistani IPv6 [REDACTED_IPv6] — Karachi, RF Score: Indeterminate
Sign-in blocked: Conditional Access + Invalid Password
Android device — not enrolled in Intune or Entra
Independent risky event in AADUserRiskEventsTable (Count: 1) — second detection system
5 prior Pakistani sign-ins in 30-day baseline — analytical complicating factor
What I Checked
30-day baseline: 77 Birmingham sign-ins, 5 prior Pakistani sign-ins — partial prior foreign presence
Current IPv6 confirmed as novel — not present in the 5 prior Pakistani sign-ins
IP enriched via Recorded Future: Pakistani IPv6 prefix, Karachi, RF Score: Indeterminate
AADUserRiskEventsTable: independent risk event (Count: 1) — second independent detection system
No Device ID — Android not enrolled in MDM or Entra
Invalid Password confirmed: no successful access, suggests stale or guessed credential
Actions Taken
Escalation sent as caution — independent AADUserRiskEventsTable flag was the deciding factor
Client security team (Cyber Security Technician) disabled account pending user confirmation
Recommended full credential reset, MFA method audit, review of all recent sign-in activity
Recommended location-based CA — block or require step-up MFA for countries without org presence
Indicators of Compromise
TypeIndicatorNotes
IPv6 Address[REDACTED_IPv6]Pakistan, Karachi — RF Score: Indeterminate
DeviceAndroid — unregistered (not Entra/Intune enrolled)Non-managed device — consistent with attacker using personal or emulated Android
Sign-in Time05:55 UTC, 30 Nov 2025Early morning UK time — outside standard business hours
Block MechanismConditional Access + Invalid PasswordTwo-layer block — no access achieved
Risk SignalAADUserRiskEventsTable Count: 1Independent Identity Protection ML risk event — second data point driving escalation
MITRE ATT&CK Mapping
TacticTechniqueIDObserved
Credential AccessBrute Force: Password Guessing / Credential StuffingT1110.001 / T1110.004Invalid password — credentials stale or guessed; possible credential stuffing
Initial AccessValid Accounts: Cloud AccountsT1078.004Attempted sign-in using compromised credentials to cloud account
Defense EvasionUse Non-Standard Port / AnonymisationT1571Sign-in from IPv6 on unregistered Android — possible evasion of device-based controls
Detection Logic (KQL)
// Full 30-day baseline including prior Pakistani sign-ins
SigninLogs
| where UserPrincipalName == "[USER_UPN]"
| where TimeGenerated > ago(30d)
| summarize Count=count() by IPAddress, Location, CountryOrRegion
| order by Count desc

// Confirm independent risk event in Identity Protection
AADUserRiskEvents
| where UserPrincipalName == "[USER_UPN]"
| where TimeGenerated > ago(7d)
| project TimeGenerated, RiskEventType, RiskLevel, IpAddress, AdditionalInfo

// Confirm no successful sign-ins from Pakistan in 7-day window
SigninLogs
| where UserPrincipalName == "[USER_UPN]"
| where CountryOrRegion == "PK"
| where TimeGenerated > ago(7d)
| where ResultType == 0
| project TimeGenerated, IPAddress, ResultType, AppDisplayName
Analyst NotesMuhammad Fezzan

The 5 prior Pakistani sign-ins in the baseline made this the most analytically complex identity alert in this portfolio. The key decision: escalate as caution vs close with monitoring.

The independent AADUserRiskEventsTable flag was the deciding factor. When baseline analysis is ambiguous, look for a second independent signal — this is the core lesson.

Post-incident, the user confirmed they were physically in the UK. The Pakistani access was a malicious actor with compromised credentials. The prior 5 Pakistani events may themselves represent earlier credential testing. Client's swift disablement was correct.

Lessons Learned
Partial prior foreign baseline complicates but does not neutralise alerts — do not dismiss based on partial baseline matching alone.
Two independent detection systems flagging the same account simultaneously drives escalation over ambiguous baseline.
Invalid Password at CA means blocked this attempt — not that no ongoing risk exists.
AADUserRiskEventsTable is the tiebreaker when baseline analysis is ambiguous.
Implement location-based CA with a documented exception process for users with legitimate international access.
Recommendations
R1Implement location-based Conditional Access: block or require step-up MFA for sign-ins from countries with no organisational presence. Named location policies in CA automate this without requiring analyst escalation for every foreign sign-in.
R2Enable Azure AD Identity Protection risk-based Conditional Access: automatic block or MFA requirement for Medium/High sign-in risk events eliminates the analyst escalation dependency for time-critical identity events.
R3Investigate and remediate the credential exposure source: with the Pakistani sign-in confirmed as malicious, the source of the credential compromise should be investigated. The user should be prompted to check for password reuse across other services. The prior 5 Pakistani baseline events should be reviewed to determine whether they represent earlier compromise activity.
R4Review historical baseline anomalies: the 5 prior Pakistani sign-ins in the baseline may not be legitimate. Conduct a retrospective review of those events to assess whether they represent undetected earlier access attempts.
SIG
Case Certification
Muhammad Fezzan
SOC ANALYST
DIGITAL TIMESTAMP
NOV 2025 // REG-009-FS
← All incidentsCase anonymised