Detection rules › Splunk
O365 Concurrent Sessions From Different Ips
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1185 Browser Session Hijacking |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body splunk
name: O365 Concurrent Sessions From Different Ips
id: 58e034de-1f87-4812-9dc3-a4f68c7db930
version: 14
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
data_source:
- O365 UserLoggedIn
search: |-
`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime values(src) as src
BY signature dest user
vendor_account vendor_product SessionId
| where mvcount(src) > 1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_concurrent_sessions_from_different_ips_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: No false positives have been identified at this time.
references:
- https://attack.mitre.org/techniques/T1185/
- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
- https://github.com/kgretzky/evilginx2
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
finding:
title: User $user$ has logged in with the same session id from more than one unique IP address
entity:
field: user
type: user
score: 50
analytic_story:
- Office 365 Account Takeover
- Scattered Lapsus$ Hunters
asset_type: O365 Tenant
mitre_attack_id:
- T1185
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips.log
sourcetype: o365:management:activity
source: o365
test_type: unit
Stages and Predicates
Stage 1: search
`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn
Stage 2: fillnull
| fillnull
Stage 3: stats
| stats count min(_time) as firstTime max(_time) as lastTime values(src) as src
BY signature dest user
vendor_account vendor_product SessionId
Stage 4: where
| where mvcount(src) > 1
Stage 5: search
| `security_content_ctime(firstTime)`
Stage 6: search
| `security_content_ctime(lastTime)`
Stage 7: search
| `o365_concurrent_sessions_from_different_ips_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Operation | eq |
|
Workload | eq |
|
sourcetype | eq |
|