New sign-in country/VPS-ISP for account inconsistent with prior history
Detects user account sign-in attempts originating from a country not observed in the previous 30 days, or from an ISP flagged as a VPN, proxy, or hosting/cloud provider. This behavior is consistent with an adversary utilizing stolen credentials or session tokens through anonymity infrastructure to bypass conditional access policies.
Microsoft Sentinel (KQL)
