Microsoft 365 - Impossible Travel Activity

Title: Microsoft 365 - Impossible Travel Activity
Status: test
Description:Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
References:
  -https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  -https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Author: Austin Songer @austinsonger
Date: 2020-07-06
modified:2021-11-27
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• service: threat_management
• product: m365

Detection:
  selection:
    eventSource: 'SecurityComplianceCenter'
    eventName: 'Impossible travel activity'
    status: 'success'
  condition:selection
Falsepositives:
  -Unknown
Level: medium