Impossible Travel Detected for User After Device Wipe/Retire
This rule detects impossible travel scenarios for user sign-ins that occur shortly after a device associated with that user has been wiped, retired, or deleted. It calculates the speed between consecutive sign-in locations for the same user and flags any travel exceeding 900 km/h, indicating a potential compromise or fraudulent activity.
Microsoft Sentinel (KQL)
