Impossible Travel with Privileged Resource Access
Detects instances where a user successfully authenticates from geographically distant locations within a short timeframe (impossible travel) followed by sensitive privileged operations within a 4-hour window.
Microsoft Sentinel (KQL)

