Bleon Proko (bproko@exaforce.com) is a legitimate employee in the Product department managed by Ariful Huq. The user has an established pattern of accessing Microsoft services from various locations including Boston, Des Moines, and Paris. This is not a test account or service account, and the user is not listed among the authorized red team personnel. The user has extensive login history across multiple sessions and applications, indicating normal business usage patterns. The account does not have organization-wide admin roles and shows no recent password resets or MFA changes, suggesting the credentials themselves remain stable.

The user authenticated from New York, US (185.202.220.69) via AS141039 (Packethub s.a.), which represents a significant deviation from historical patterns. Analysis of 90-day historical data shows the user typically connects from Boston (multiple ASNs), Des Moines (Microsoft infrastructure), and Paris (Microsoft infrastructure). Critically, AS141039 has never been observed before for this user. Packethub s.a. appears to be a hosting/VPS provider rather than a known enterprise VPN solution like Zscaler (AS53813) or Netskope (AS55256). The geographic distance from New York to Boston (~200 miles) is reasonable, but combined with timing creates impossible travel scenarios. This ASN change suggests potential use of unauthorized proxy or compromised infrastructure.

Session c3e1653a-f063-4716-a130-c2cb4fa70d00 shows successful authentication to Microsoft Authentication Broker at 2025-08-08 18:12:21 UTC. The session involved multiple authentication events within a short timeframe (31 seconds), suggesting typical modern authentication flows. However, the session originates from infrastructure never before associated with this user. The session appears isolated from the user's typical Microsoft-based authentication patterns. User agent information indicates a Windows device with Edge browser, but Azure flagged this as unfamiliar device/browser properties, suggesting potential device spoofing or compromise.

Azure Identity Protection flagged unfamiliar device properties including UnfamiliarDevice and UnfamiliarBrowser. The reported user agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; MSAppHost/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045' suggests a Windows device with Edge browser. However, the user typically uses similar user agents from other locations, so the unfamiliarity likely relates to device fingerprinting beyond just user agent strings. The device properties combined with the unfamiliar ASN suggest potential access from a compromised or unauthorized device.

The user successfully performed authentication to Microsoft Authentication Broker, a critical application for accessing Microsoft services. This represents successful Sign-in activity with access type 'authenticate' to resource 29d9ed98-a469-4536-ade2-f981bc1d605e. The authentication was successful (not challenged or failed), indicating the attacker had valid credentials. Microsoft Authentication Broker is a high-value target as it can provide access to multiple Microsoft services. The timing of successful authentication followed by rapid appearance in other locations suggests potential credential abuse or session hijacking.

The most concerning behavioral anomaly is the impossible travel pattern. Within 19-55 minutes of the New York authentication at 18:12:21 UTC, the user appeared active from Boston (19:07:12 UTC) and Des Moines (19:07:07 UTC). This creates a physically impossible scenario that strongly suggests either account compromise, credential sharing, or sophisticated attack techniques. The user's normal behavior shows consistent patterns from known corporate infrastructure, making this deviation particularly significant. The combination of unfamiliar ASN usage and impossible travel represents a clear behavioral departure from established patterns.

This threat is classified as external_threat based on several indicators: the use of unfamiliar hosting infrastructure (Packethub s.a.) that is not associated with the organization's known VPN providers, the impossible travel patterns suggesting potential account compromise, and the successful authentication from infrastructure never before seen for this user. The threat actor appears to have obtained valid credentials and is attempting to access Microsoft services from unauthorized infrastructure. The sophisticated nature of maintaining valid credentials while accessing from new infrastructure suggests an external threat actor rather than insider activity.

This activity maps to Initial Access (TA0001) as the threat actor is gaining initial foothold into the organization's cloud environment. The technique is Valid Accounts (T1078) since legitimate credentials are being used for authentication. The sub-technique is Cloud Accounts (T1078.004) as this involves Azure AD authentication. The threat actor has successfully obtained valid credentials and is using them to authenticate to cloud services, which represents the initial access phase of a potential attack chain. The use of unfamiliar infrastructure suggests the credentials may have been compromised through external means.

Reviewing business context rules, Bleon Proko is not mentioned among the authorized red team personnel (Chandra Mallam, Chirag Patel, Jakub Pavlik, Devesh Mittal, Sujesh, Chitra, and Madhukar) who simulate attacks. The user is also not Nivia Thompson (who travels to Miami and Puerto Rico) or Ankur Singla (CEO who travels extensively). This is a standard Product department employee with no special travel authorization or testing privileges mentioned in the business context. Therefore, the unfamiliar location and infrastructure usage cannot be attributed to authorized business activities or security testing.

Priority level 1 (high) is assigned based on the combination of high severity (4), NeedsInvestigation recommendation, and critical business context. The high severity reflects the impossible travel scenario and use of never-before-seen infrastructure by a legitimate employee. The recommendation for investigation is driven by strong indicators of potential account compromise. The business context shows this is not authorized testing activity. This combination requires immediate action within hours to prevent potential lateral movement or data access by unauthorized parties.

A formal confirmation workflow was initiated to verify the legitimacy of this authentication activity. The workflow escalated through three levels: 1) Primary user Bleon Proko (bproko@exaforce.com) from Product department - resulted in timeout with no response within the specified timeframe, 2) Manager Ariful Huq (ahuq@exaforce.com) from Product department - also resulted in timeout with no response within the specified timeframe, 3) CEO Ankur Singla (asingla@exaforce.com) - definitively confirmed that the activity is NOT LEGITIMATE. The failure of both the user and manager to respond, combined with explicit CEO confirmation of illegitimate activity, conclusively establishes this as a confirmed security incident requiring immediate escalation and incident response procedures.