Residential-Proxy / Commercial-VPN Sign-in Diverging from User's Geo Baseline
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Microsoft Sentinel (KQL)
