LoFP / user using a vpn may lead to false positives.

Techniques

• T1078

Sample rules

Microsoft 365 Impossible travel activity

• source: elastic
• technicques:
  • T1078

Description

Identifies when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Detection logic

event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Impossible travel activity" and event.outcome:success