Multi-Stage Identity Compromise via Rotating IP Infrastructure

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

This rule detects suspicious cloud user activity by identifying a single user account engaging in diverse, multi-stage actions (Authentication, MFA updates, Reconnaissance, and Exfiltration) originating from a high number of distinct source IP addresses. This behavioral pattern is indicative of a compromised account where an adversary is rotating IPs while performing a coordinated, multi-stage attack sequence.