Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt

'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group. Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'