Finding suspicious access

Start with a focused scope

Begin with the affected account and an initial time window around the reported activity. Record what prompted the investigation, such as a suspicious inbox rule or a fraudulent email.

Use the available audit and sign-in records. Widen the time window or include other accounts when the evidence points beyond the initial scope.

Extract unique IP addresses

An IP address can help connect records to a network source. Extract the IP addresses associated with the account and create a list in which each address appears once. Keep the original event records.

Deduplication

Removing repeated values so each IP address appears once.

Why it helps

A thousand events might contain only ten unique IP addresses. Reviewing that smaller list helps choose where to investigate next.

This reduces the number of leads, not the amount of evidence. Keep the original events so you can return to the activity behind each address.

Understand normal user activity

A baseline is the activity we would normally expect for the user.

Location

Where does the user normally work, and have they travelled recently?

Network

Which office, home, mobile or VPN networks do they use?

Applications and devices

Which clients and devices do they usually use?

Timing

Does the activity fit the user’s usual working hours?

Triage the IP list

Use IP intelligence to add context to the logs. IP-API (opens in a new tab) provides approximate location and network-provider information. AbuseIPDB (opens in a new tab) shows reports of abuse associated with an IP address.

Geolocation

An approximate location associated with the IP, rather than proof of the person’s physical location.

Provider

Whether the address belongs to a residential ISP, hosting provider, mobile network or other service.

Reputation

Reports of previous abuse that may support a lead, but do not establish what happened in this incident.

A VPN, hosting provider or unfamiliar country can deserve investigation, but it is not automatically malicious. Compare several sources with the actual sign-in and audit activity.

Follow a known suspicious event

If an unauthorised inbox rule is already identified, inspect its account, time, IP address and any session identifier. That event can provide a stronger starting point than an unfamiliar location alone.

For example, a user normally based in Melbourne might have activity associated with an overseas hosting provider. Check travel, VPN use, authentication results and mailbox events around the same time before attributing it to an attacker.

Keep a working list of leads

Expected

Activity that fits the user’s normal behaviour and available evidence.

Suspicious

Activity needing further checks or supporting evidence.

Activity linked to the compromise

Activity linked to the compromise by the investigation evidence.

Record the reason for each assessment. Keep uncertain leads visible and revisit them when new evidence appears.