VPN Sign-In After 3+ Failed Attempts With Impossible Travel
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
Microsoft Sentinel (KQL)

