Privileged User Logon from new ASN
'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
Microsoft Sentinel (KQL)
