Azure Entra unlikelyTravel Risk Events Indicating Atypical Travel Between Distant Sign-Ins

Alerts on unlikelyTravel risk events tied to geographically distant sign-ins and potential deviation from user travel history.

FreeUnreviewedSigmahighv1

azure-entra-unlikelytravel-risk-events-indicating-atypical-travel-between-distan-1a41023f

title: Azure Entra unlikelyTravel Risk Events Indicating Atypical Travel Between Distant Sign-Ins
id: 3059e7ed-d0fc-422b-9b63-b429f32a12d9
status: test
description: This rule flags risk events classified as unlikelyTravel when two sign-ins are detected from geographically distant locations, with at least one location potentially inconsistent with the user’s historical behavior. Such patterns can indicate account access from an unexpected location, which attackers may use to avoid detection or establish persistence. The detection relies on Azure Entra risk telemetry from the riskdetection service identifying the unlikelyTravel riskEventType.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: unlikelyTravel
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 1a41023f-1e70-4026-921a-4d9341a9038e
    type: derived

What it detects

This rule flags risk events classified as unlikelyTravel when two sign-ins are detected from geographically distant locations, with at least one location potentially inconsistent with the user’s historical behavior. Such patterns can indicate account access from an unexpected location, which attackers may use to avoid detection or establish persistence. The detection relies on Azure Entra risk telemetry from the riskdetection service identifying the unlikelyTravel riskEventType.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.