Azure Entra Risk: Impossible Travel Sign-In Detection (impossibleTravel)

Flags Azure Entra risk events tagged as impossibleTravel indicating implausible geographic sign-in travel within a short time.

FreeUnreviewedSigmahighv1

azure-entra-risk-impossible-travel-sign-in-detection-impossibletravel-b2572bf9

title: "Azure Entra Risk: Impossible Travel Sign-In Detection (impossibleTravel)"
id: 74080b9d-95fc-4779-9630-8e1b91328ead
status: test
description: This rule identifies risk events in Azure Entra that are classified as impossible travel, where user activity appears to originate from geographically distant locations within an implausibly short time window. Such behavior matters because it can indicate account compromise or attacker-controlled sign-ins that evade normal travel patterns. The detection relies on Azure risk detection telemetry, specifically risk events labeled with riskEventType as "impossibleTravel."
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: impossibleTravel
  condition: selection
falsepositives:
  - Connecting to a VPN, performing activity and then dropping and performing additional activity.
level: high
license: DRL-1.1
related:
  - id: b2572bf9-e20a-4594-b528-40bde666525a
    type: derived

What it detects

This rule identifies risk events in Azure Entra that are classified as impossible travel, where user activity appears to originate from geographically distant locations within an implausibly short time window. Such behavior matters because it can indicate account compromise or attacker-controlled sign-ins that evade normal travel patterns. The detection relies on Azure risk detection telemetry, specifically risk events labeled with riskEventType as "impossibleTravel."

Known false positives

Connecting to a VPN, performing activity and then dropping and performing additional activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.