Service Account Impossible Travel: Multi-Country Auth Within 30 Minutes

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.