Update Impossible-Travel.yaml

Azure · Oct 7, 2024 · e1b1491 · e1b1491
1 parent fdf15e3
commit e1b1491
Showing 1 changed file with 1 addition and 5 deletions.
diff --git a/Detections/Impossible_Travel/Impossible-Travel.yaml b/Detections/Impossible_Travel/Impossible-Travel.yaml
@@ -12,13 +12,9 @@ queryPeriod: 24h
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
-  - ValidAccounts
-  - ApplicationLayerProtocol
-  - Masquerading
+  - InitialAccess
 relevantTechniques: 
   - T1078
-  - T1071
-  - T1036
 query: |
   let maxSpeed = 1000;
   SigninLogs