Sign-In from New Country Not Seen in 30-Day Baseline (T1078.004)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.