Unrelated Employees Authenticating from One Fixed-Line Address

Addresses shared by two or more employees outside your own egress; fill the CorporateEgress ranges first or the output is meaningless.

// Hunt: unrelated employees signing in from one fixed-line address (a laptop-farm signature).
let CorporateEgress = dynamic([
    "198.51.100.0/24",   // replace with your own office and VPN egress ranges
    "203.0.113.0/24"
]);
// optional: restrict to accounts first seen in the last 120 days; the first sign-in is only a proxy for hire date and fails in a recently migrated tenant
let RecentHires = SigninLogs
    | where TimeGenerated > ago(180d)
    | summarize FirstEverSignIn = min(TimeGenerated) by UserPrincipalName
    | where FirstEverSignIn > ago(120d)
    | project UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(90d)
| where ResultType == "0"
| where not(coalesce(ipv4_is_in_any_range(IPAddress, CorporateEgress), false))
// optional: recent hires only
| where UserPrincipalName in (RecentHires)
| summarize Users = dcount(UserPrincipalName), UserList = make_set(UserPrincipalName, 25),
            SignIns = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by IPAddress
| where Users >= 2
| sort by Users desc

Addresses shared by two or more employees outside your own egress; replace the placeholder CIDR ranges first.

```Placeholder: index=identity holds Okta, Entra ID or ms:aad:signin events with action, src_ip and user extracted.```
index=identity (sourcetype=okta OR sourcetype=azuread OR sourcetype="ms:aad:signin") action=success earliest=-180d
| eventstats min(_time) AS first_ever BY user
| where _time >= relative_time(now(), "-90d")
```replace the two placeholder ranges with your own office and VPN egress ranges```
| where NOT (cidrmatch("198.51.100.0/24", src_ip) OR cidrmatch("203.0.113.0/24", src_ip))
```optional: recent hires only; the first sign-in is a proxy for hire date and fails in a recently migrated tenant```
| where first_ever >= relative_time(now(), "-120d")
| stats dc(user) AS distinct_users values(user) AS users count AS signins min(_time) AS first_seen max(_time) AS last_seen BY src_ip
| where distinct_users >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - distinct_users

Same logic over ingested Entra ID or Okta events, reading the address and user from the raw JSON; the recent-hires restriction is not expressible without a first-seen lookup.

// Hunt: unrelated employees signing in from one fixed-line address. Fields are read from the raw Entra ID or Okta JSON (ipAddress, userPrincipalName, alternateId), so no parser field name is assumed.
/"resultType"\s*:\s*"0"|"result"\s*:\s*"SUCCESS"/i
| regex("ipAddress[\" :]+(?<ip>[0-9a-fA-F:.]+)", strict=false)
| regex("(?:userPrincipalName|alternateId)[^a-zA-Z0-9_]+(?<user>[^\"]+)", strict=false)
| ip=* user=*
// replace the placeholder ranges with your own office and VPN egress ranges
| !cidr(ip, subnet=["198.51.100.0/24", "203.0.113.0/24"])
| groupBy([ip], function=[count(user, distinct=true, as=users), collect([user], limit=25), count(as=signIns), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| users >= 2
| sort(users, order=desc)

Same logic over the Entra ID and Okta integrations; the recent-hires restriction needs a first-seen join that ES|QL does not express here.

FROM logs-azure.signinlogs-*, logs-okta*
| WHERE @timestamp > NOW() - 90 days
| WHERE event.outcome == "success"
| WHERE NOT CIDR_MATCH(source.ip, "198.51.100.0/24", "203.0.113.0/24")
| EVAL account = COALESCE(azure.signinlogs.properties.user_principal_name, user.name)
| STATS users = COUNT_DISTINCT(account), user_list = VALUES(account), sign_ins = COUNT(*), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY source.ip
| WHERE users >= 2
| SORT users DESC