Suspicious Impossible Travel Logon - M365
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Identifies Entra ID user sign-ins from different geolocations within a time window that makes legitimate travel impossible. This anomaly may suggest that the account credentials have been compromised and used from multiple IP addresses or devices across regions.
Severity
Critical
Rule Requirement
Criteria
e1:
actionname = "DETECTION_ACTION_M365_SUCCESSFUL_LOGON" AND CALLER contains "@"
| groupby CALLER
| groupby HOSTNAME having dcount(SOURCE_COUNTRY) > 1
| last 1 IPADDRESS
select e1.HOSTNAME, e1.CALLER, e1.HOSTNAME.IPADDRESS, e1.HOSTNAME.SOURCE_COUNTRY
Detection
Execution Mode
scheduled
Log Sources
Microsoft 365
