Cross-stage IP rotation across auth, recon, and exfil for same identity

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

This rule monitors cloud and identity logs to detect a single user identity exhibiting multiple stages of suspicious activity (authentication, reconnaissance, and exfiltration) within a 24-hour period while utilizing distinct, non-overlapping source IP addresses for each stage. This behavior is indicative of an account compromise where different stages of the attack chain originate from different infrastructure.