Kali365 - Impossible Travel Device Code Use

Ibrahim Saud@tektrix

•updated Jun 22, 2026•4•0•15

Identifies geographic impossible travel where the device code was requested in one country and successfully authenticated from another within minutes. This rule looks for a single AccountUpn having activity from two or more distinct locations within a 10-minute window.