Suspicious Impossible Travel Logon - Network
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Detects potential unauthorized access to network infrastructure where the same user account authenticates from two or more distant IP geolocations in an unrealistically short time frame. This may suggest stolen credentials or attacker access through VPN or proxy tunneling.
Severity
Critical
Rule Requirement
Criteria
e1:
actionname = "DETECTION_ACTION_NETWORK_VPN_LOGON_SUCCESS"
| groupby USERNAME
| groupby HOSTNAME having dcount(SOURCE_COUNTRY) > 1
| last 1 SOURCE_IP,REMOTEHOST
select e1.HOSTNAME, e1.USERNAME, e1.HOSTNAME.SOURCE_IP, e1.HOSTNAME.REMOTEHOST, e1.HOSTNAME.REMOTE_IP, e1.HOSTNAME.SOURCE_COUNTRY
Detection
Execution Mode
scheduled
Log Sources
Network
