ConceptsImpossible Travel Hunting

Impossible Travel Hunting

A threat-hunting technique that searches authentication data for impossible-travel patterns across accounts, proactively finding credential compromise that automated alerts may have missed or that spans accounts.

Glossary definition

6 direct links6 lessons

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Hunt Hypothesis

The foundation Impossible Travel Hunting builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Hunt HypothesisStart here

A specific, testable statement of what malicious activity might be present and how it would show up in data, that drives a threat hunt, giving it a clear question to investigate rather than aimless searching.

lessons

Relatedsorted by lesson coverage

Cloud Hunting Data Sources

lessons

IAM Threat Detection

lessons

Identity Hunting Value

lessons

Impossible Travel

lessons

Identity Anomaly Detection

lesson

Related Lessons

6 lessons cover this concept

Preparing a Defensible Hunt

SOC Analyst

Living-Off-The-Land Behavior Chains

SOC Analyst

Cloud Control-Plane and Workload Hunts

SOC Analyst

Identity, Session, and Token Hunts

SOC Analyst

Persistence, Memory, and Telemetry Evasion

SOC Analyst

Hunt Program Decisions and Measurement

SOC Analyst