Entra session country shift
One session appearing from two countries inside an hour.
What it detects
One session appearing from two countries inside an hour.
This is impossible travel measured against the SESSION rather than against a new sign-in, which is the gap it exists to close. Conditional Access and Identity Protection evaluate at authentication time; a session that is already open is not re-evaluated, so a stolen token used from another country produces no risky sign-in, no MFA prompt and no policy hit — the activity simply continues, and the only trace is that the same session id is now reporting a different location.
Country rather than city because the coarse unit is the one that survives geolocation error. Two cities in one country is a database artifact; two countries in an hour is a person who did not move.
MITRE ATT&CK mapping
False positives and triage
Corporate VPNs and cloud egress are the dominant false positive: a user whose traffic exits through a gateway in another country produces exactly this pattern, and so does a roaming user near a border whose carrier geolocates inconsistently. Check whether the second country's address belongs to a known VPN or hosting provider before treating the pair as travel — an egress range is a configuration fact and should be allowlisted once.
Geolocation of mobile carrier ranges is also unreliable at country granularity in a few regions. Two countries that are geographic neighbours deserve more scepticism than two continents apart. Read this rule with the device and user-agent evidence open: a country change ALONE is weak, while a country change that arrives with a new device id or a scripted client is the same finding twice and should be escalated.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/entra_session_country_shift.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_session_country_shift
version: 1.0.0
status: experimental
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1539, T1078.004]
description: |
One session appearing from two countries inside an hour.
This is impossible travel measured against the SESSION rather than against a new
sign-in, which is the gap it exists to close. Conditional Access and Identity
Protection evaluate at authentication time; a session that is already open is not
re-evaluated, so a stolen token used from another country produces no risky
sign-in, no MFA prompt and no policy hit — the activity simply continues, and the
only trace is that the same session id is now reporting a different location.
Country rather than city because the coarse unit is the one that survives
geolocation error. Two cities in one country is a database artifact; two
countries in an hour is a person who did not move.
match:
event_category: authentication
threshold:
count: 2
# An hour is short enough that no commercial flight closes the distance, so the
# window itself carries the "impossible" part of impossible travel.
window_seconds: 3600
distinct: ext:country
group_by: [session_id, user_name]
correlation_keys: [user_name, session_id, source_ip]
false_positive_guidance: |
Corporate VPNs and cloud egress are the dominant false positive: a user whose
traffic exits through a gateway in another country produces exactly this pattern,
and so does a roaming user near a border whose carrier geolocates inconsistently.
Check whether the second country's address belongs to a known VPN or hosting
provider before treating the pair as travel — an egress range is a configuration
fact and should be allowlisted once.
Geolocation of mobile carrier ranges is also unreliable at country granularity in
a few regions. Two countries that are geographic neighbours deserve more
scepticism than two continents apart. Read this rule with the device and
user-agent evidence open: a country change ALONE is weak, while a country change
that arrives with a new device id or a scripted client is the same finding twice
and should be escalated.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.