Microsoft 365 Impossible Travel Activity via SecurityComplianceCenter Successful Sign-In

title: Microsoft 365 Impossible Travel Activity via SecurityComplianceCenter Successful Sign-In
id: 984d40ec-5b64-498d-bb4a-436d61e172ff
status: test
description: This rule flags successful “Impossible travel activity” alerts reported by Microsoft Cloud App Security through the SecurityComplianceCenter. Such sign-in anomalies can indicate account compromise or attacker attempts to evade detection by using logins that do not align with expected travel patterns. The detection relies on threat management telemetry containing the eventSource, eventName, and a successful status associated with the impossible travel finding.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2020-07-06
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Impossible travel activity
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d7eab125-5f94-43df-8710-795b80fa1189
    type: derived