Credential Compromise Detected: Valid Credentials Used from Luxembourg Hosting Provider but Blocked by Conditional Access

Initial Signal

On February 25, 2026, Microsoft Entra ID detected a failed authentication attempt for user_1@[INTERNAL_DOMAIN_1].com, a Philippines-based [ROLE_1] in [ORG_1]. The attempt originated from IP address [EXTERNAL_IP_1] in Luxembourg, registered to FranTech Solutions, a hosting provider. The alert mapped to MITRE technique T1078 (Valid Accounts), a credential-based attack vector. What made this signal stand out: the authentication used valid credentials (Password Hash Sync confirmed the password was correct), yet came from an impossible location for the user's profile. The attacker used ROPC (Resource Owner Password Credentials) protocol with a node-fetch user agent—a programmatic access pattern, not a browser login. The device was unmanaged and non-compliant. Microsoft Entra ID's risk engine flagged the attempt as high-risk and Conditional Access policies blocked token issuance. The investigation correlated Microsoft Entra ID sign-in logs and user resource data across 3 invocations in 3 minutes 8 seconds, revealing no successful logins from the suspicious IP and confirming the user lacks MFA protection.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified the authentication attempt used valid credentials
   Pass
2. fp2
   Analyzed location and access method for legitimacy
   Pass
3. fp3
   Evaluated for potential business travel scenario
   Pass
4. fp4
   Checked for potential legitimate automation or scripting
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Credential Compromise at high confidence rests on the following mutually corroborating signals:

1. Password Hash Sync validation confirms the attacker possessed the correct password for user_1@[INTERNAL_DOMAIN_1].com, proving credential compromise occurred

2. The authentication attempt from FranTech Solutions (a hosting provider in Luxembourg) contradicts the user's Philippines-based profile with no evidence of authorized travel, indicating unauthorized use

3. ROPC protocol and node-fetch user agent demonstrate programmatic access rather than legitimate user behavior, consistent with credential-stuffing or brute-force automation

4. Microsoft Entra ID's high-risk assessment and Conditional Access block confirm the attempt was correctly identified as suspicious by security controls

5. The user's lack of MFA registration and capability made the account vulnerable to credential-based attacks once the password was compromised. Confidence is High rather than Confirmed because the investigation did not recover forensic evidence of how the credentials were initially compromised (e.g., phishing, malware, data breach source), only that they were used maliciously

Lessons

1. 01
   Blocked attempts reveal compromise, not containment. This investigation shows a credential compromise where the attacker had the correct password but was stopped by Conditional Access. The block is a win for detection, but the real finding is that credentials were already in an attacker's hands. The organization should assume the password is compromised and force a reset immediately, then audit all successful logins from this user's account in the preceding weeks to identify when the compromise occurred and what else the attacker accessed.
2. 02
   MFA absence turns credential compromise into account compromise. User_1 lacks MFA registration and capability. If Conditional Access had not blocked this attempt, the attacker would have obtained a valid token and gained full account access. The hosting provider IP and ROPC protocol would have bypassed interactive MFA prompts anyway. Mandate MFA for all users, especially those in leadership roles ([ROLE_1]) with access to sensitive systems.
3. 03
   Hosting provider IPs are a credential-attack signature. FranTech Solutions is a hosting provider; legitimate business access does not originate from hosting infrastructure. When you see authentication from AWS, Azure, DigitalOcean, Linode, or similar providers, treat it as a credential-attack indicator unless the user is explicitly authorized to access from that IP (e.g., a remote worker using a VPN hosted on that provider). Build a blocklist or high-confidence alert rule for hosting provider IP ranges.
4. 04
   ROPC + non-browser user agent = programmatic attack. ROPC (Resource Owner Password Credentials) is a legacy OAuth flow designed for first-party applications. When combined with user agents like node-fetch, curl, or Python requests, it signals automated credential usage. Interactive users should authenticate via browser-based flows (Authorization Code) that support MFA. Restrict ROPC to service accounts and require IP allowlisting for any ROPC usage.
5. 05
   Geographic impossibility is a strong signal. User_1 is based in the Philippines ([SITE_1]) with no evidence of travel to Luxembourg. A failed login from Luxembourg is not just unusual—it is impossible without credential compromise or account takeover. Implement geographic anomaly detection that flags logins from countries where the user has never authenticated before, especially when combined with other risk factors (unmanaged device, non-standard protocol, hosting provider IP).