Single credential authenticating from many distinct IPs in short window (pooled/rotating account signal)
Detects a single user account authenticating from an unusually high number of distinct IP addresses within a short timeframe (1 hour), which may indicate the use of rotating proxy services or account sharing, commonly associated with unauthorized access or reseller activity.
Microsoft Sentinel (KQL)
