Microsoft 365 - Impossible Travel Activity Detected

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•58

Detects when Microsoft Cloud App Security (MCAS) reports a risky sign-in attempt due to an impossible travel scenario. This indicates a potential compromise of user credentials where an attacker logs in from a geographically distant location in a short timeframe, making physical travel impossible.