Impossible Travel / Possible Session Token Replay

Ankit Mehta@Secvyn

•updated Sep 9, 2026•0•0•2

This rule monitors Azure AD Sign-in logs to identify 'impossible travel' scenarios, where a user authenticates successfully from two geographically distant locations within a time window (1 hour) that would require travel speeds exceeding a plausible threshold. This behavior is a common indicator of credential compromise or session token replay attacks.