Successful Authentication from Non-Operational Country

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

This rule detects successful user authentications originating from geographic locations (countries) that are not designated as operational areas for the organization. This helps identify potential unauthorized access attempts or compromised accounts being used from unexpected locations.