Atypical Travel

Status: test
Severity: high
Log source: product azure, service riskdetection
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Source: github.com/SigmaHQ/sigma

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Rule body

title: Atypical Travel
id: 1a41023f-1e70-4026-921a-4d9341a9038e
status: test
description: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'unlikelyTravel'
    condition: selection
falsepositives:
    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    riskEventType: 'unlikelyTravel'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`riskEventType`	eq	`unlikelyTravel`	`field:"azure_ad::risk_event_types" kind:eq value:"unlikelyTravel"`