-
Google Workspace Impossible Travel Login
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Google Workspace Data Source: Google Workspace User Log Events Data Source: Google Workspace Audit Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: Medium Performance: Fast Profile: Recommended Threat: Impossible Travel Rule Type: ES|QL Platform: Google Workspace Domain: SaaS ·Detects successful Google Workspace sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user.
Read More -
M365 Identity Login from Atypical Region
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Impossible Travel Rule Type: New Terms Platform: Microsoft 365 Domain: SaaS ·Detects successful Microsoft 365 portal logins from a country and region the user has not previously authenticated from in a specific time window. Atypical regions are identified by combining the user's country and region geolocation history; an authentication from a new country/region pair for that user may indicate an adversary attempting to access the account from an unusual location or behind a VPN.
Read More -
M365 Identity Login from Impossible Travel Location
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Impossible Travel Rule Type: Threshold Platform: Microsoft 365 Domain: SaaS ·Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location.
Read More -
Microsoft Entra ID Impossible Travel Sign-in
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-In Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Impossible Travel Rule Type: ES|QL Platform: Entra ID ·Detects successful Microsoft Entra ID interactive sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user. Non-interactive sign-in categories are excluded because backend token refresh activity routinely egresses through cloud regions unrelated to the user. This activity is often observed from AiTM phishing kits or successful phishing campaigns.
Read More