OneLogin User Logins From Multiple Countries
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
YARA-L
