Unusual Authentication Outside Business Hours and Locations

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•107

Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.