Multiple Interactive Logons from Different IPs

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects an account performing multiple interactive logons (LogonType 2) from at least 3 unique IP addresses within a 5-minute window. This behavior can indicate credential compromise or an adversary attempting to move laterally or access multiple systems using stolen credentials.