One Login.
Three Ways It Goes Wrong.
Password spray, brute force, impossible travel, and a login from a country with no business reason to be there are four alert names for the same underlying question: is this still the account owner. Triaged as one pattern here, from trigger to containment. For the AD-specific spray/brute-force targets (Kerberoasting, service accounts, and the rest), see ADPATH.
Alert Overview
Four detection names, one identity provider risk signal underneath all of them.
The Four Triggers
Password Spray [T1110.003] Many accounts, few attempts each, one or a small set of source IPs └── Built to stay under per-account lockout thresholds, so volume alone often won't trip it Brute Force [T1110] Many attempts, one account, from one or a small set of source IPs └── The inverse shape of a spray: depth on one target instead of breadth across many Impossible Travel Two successful logins from locations no real travel time could reconcile └── Flagged by the identity provider's own geo-velocity check, not a manual calculation Non-Business-Country Login A login, successful or attempted, from a country the org has no presence, staff, or partner in └── A policy-based geofence hit, not a behavioral anomaly like the other three // all four typically surface from the same source: Azure AD Identity Protection, Okta, AWS IAM, or a SIEM correlation rule built on raw auth logs
Initial Triage Steps
The same five checks answer all four alert types.
Five Checks, In Order
1. Identify the exact shape Spray (many accounts, few attempts) vs brute force (one account, many attempts) vs a single geo-anomaly (impossible travel or non-business-country) on an otherwise normal login pattern 2. Check outcome, not just occurrence Failed-only is a different urgency tier than a successful authentication following the pattern └── A single success buried in hundreds of failures is the one that matters 3. Pull the source IP(s) Reputation, ASN, and whether it resolves to a known VPN, residential proxy, or Tor exit node 4. Check the targeted account(s) Privileged account vs standard user vs a service account authenticating interactively at all // a service account showing up in an interactive login alert is its own finding, regardless of the geo signal 5. Check MFA status Satisfied normally, challenged and denied, challenged repeatedly, or bypassed entirely
True Positive Indicators
What separates a real account-takeover attempt from identity-provider noise.
TRUE POSITIVE
Success After A Spray Pattern
The spray did its job on at least one account
A successful authentication that follows a many-accounts-few-attempts pattern from the same source means at least one password in the sprayed set was correct. Treat the account as compromised, not just targeted.
TRUE POSITIVE
Unexplained Impossible Travel
No VPN, no travel record, no corporate egress point explains it
Two successful logins from locations no real travel could reconcile, with nothing on file (approved VPN, known travel, CASB egress) to explain the second location.
TRUE POSITIVE
Geofence Hit With No Business Reason
No traveling employee, no partner, no vendor there
A login from a country with no business relationship, no known traveling staff member, and no documented VPN egress point in that region.
TRUE POSITIVE
MFA Fatigue Pattern [T1621]
Repeated push prompts are the attack, not a side effect of it
A burst of MFA push notifications the user didn't initiate is a deliberate technique on its own, regardless of whether the user eventually approved one by mistake or denied all of them.
TRUE POSITIVE
Known-Bad Source Infrastructure
The IP has a history before this alert ever fired
The source IP or ASN matches known malicious infrastructure, an anonymization service, or bulletproof hosting on threat intel, independent of anything about this specific login attempt.
False Positive Indicators
Legitimate reasons an identity provider's geo-velocity math can look identical to an attack.
FALSE POSITIVE
Confirmed Travel
Calendar, expense report, or a heads-up beats a guess
The employee is confirmed traveling, with a calendar entry, an expense record, or a direct heads-up that lines up with the flagged location and timing.
FALSE POSITIVE
Approved VPN Or CASB Egress
The "foreign" IP is the company's own exit point
A corporate VPN or CASB egress point legitimately geolocates to a country or region that looks anomalous on its own, but is a known, documented routing path.
FALSE POSITIVE
Documented Service Account Behavior
A fixed IP that just happens to geolocate oddly
A known integration or service account with a documented, unchanging source IP, where the odd geolocation traces back to a cloud provider's region rather than anything suspicious.
FALSE POSITIVE
A Single Mistyped Password
One account, one bad attempt, no pattern
One or two failed logins on one account with no spray or brute-force shape behind them is ordinary user error, not an attack signature.
Escalation Criteria
When this stops being an identity-provider alert and starts being an incident.
ESCALATE
Any Success On A Privileged Account
The highest-priority version of this alert
A successful authentication following any of the four suspicious patterns, on an account with elevated access, escalates immediately and gets treated as a probable compromise, not a login anomaly.
ESCALATE
MFA Fatigue, Regardless Of Outcome
The attempt is the signal, not just the result
A repeated MFA push pattern escalates whether or not the user ultimately approved one. It's a deliberate technique aimed at this specific account, not background noise to dismiss because it was denied.
ESCALATE
Multiple Accounts, Same Pattern, Same Window
Coordination, not coincidence
Several accounts showing the same anomaly at the same time is a campaign against the organization, not a series of unrelated individual alerts to close out one by one.
Containment Actions
What actually closes the account off from further use once compromise is confirmed or strongly suspected.
CONTAIN
Reset Password And Revoke Sessions
A password reset alone leaves an existing session valid
Force a password reset and revoke every active session and token for the account, not just the password. A live session survives a password change until it's explicitly killed.
CONTAIN
Re-Register MFA If In Doubt
Don't trust the same MFA method that may have just been bypassed
If there's any chance the MFA method itself was compromised, phished, or fatigued into approval, require re-registration rather than assuming the existing method is still trustworthy.
CONTAIN
Block The Source At The Edge
Both at the identity provider and the network perimeter
Block the source IP or ASN at the identity provider's conditional access layer and at the network edge, so a blocked login attempt can't simply retry through an unmonitored path.
CONTAIN
Audit OAuth Consents And Mailbox Rules
The pivot an attacker makes once they have a live session
Review and revoke any OAuth app consents or forwarding/inbox rules granted during the suspected compromise window. A live-session attacker often plants this kind of persistence before the account gets locked down.
CONTAIN
Escalate Scope If The Account Was Privileged
A privileged compromise is an investigation, not a reset
If the account carried elevated access, treat this as a broader compromise investigation covering what that access could have touched, not a closed ticket once the password is reset.