Distinct source IPs across auth, recon, and exfil stages of same identity

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects a single user account authenticating, performing Graph API reconnaissance, and conducting data exfiltration across three distinct source IP addresses within a one-hour window. This behavior is indicative of threat actors like Storm-3121 or Storm-3032 rotating infrastructure per attack stage to evade network-based detection.