D3-UGLPA

User Geolocation Logon Pattern Analysis

Analyze user login locations to detect impossible travel, VPN anomalies, and potential account compromise.

D3FEND / Detect

Implementation

  • Map login geolocations
  • Calculate travel time between logins
  • Alert on impossible travel scenarios
  • Track VPN and proxy usage
  • Integrate with identity provider

Tools

  • Azure AD Identity Protection
  • Okta ThreatInsight
  • Duo Security
  • CrowdStrike Falcon
  • Abnormal Security

ATT&CK mappings

3

MITRE D3FEND ↗