highMicrosoft Sentinel · 15 minutes

Impossible travel, and then a mailbox rule

The alert, as it arrived

Microsoft Sentinel

[03:14:07] INCIDENT 48221 · Sentinel · Severity: High
Rule: Impossible travel activity
Entity: m.okafor@<redacted>.com

  SigninLogs
    03:02:41  IP 81.***.***.22    Lagos, NG     Success  MFA: satisfied (claim in token)
    02:51:19  IP 92.***.***.140   Dublin, IE    Success  MFA: satisfied (claim in token)
    Distance 5,102 km · Elapsed 11m 22s

  Correlated (03:11:55):
    OfficeActivity
      Operation:  New-InboxRule
      Parameters: Name="..."; MoveToFolder="RSS Subscriptions";
                  SubjectContainsWords="invoice,payment,wire,bank,remittance";
                  MarkAsRead=$true
      ClientIP:   81.***.***.22

  Assigned: unassigned
  Analyst note (auto): user is in the Finance distribution group

Your turn

You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.

Write it down before you scroll. The value of this is in committing to an answer you can be wrong about, and reading the breakdown first removes it entirely.

Analyst breakdown

Pro

Unlock the expert breakdown and hunting queries with a Pro membership.

5 steps in order, each with the reasoning and a runnable query, plus the trap most responders fall into on this one and what the incident actually turns out to be. The scenario above stays free and complete: work it first, and the breakdown is worth more.

See what is included Sign in