Time Travelers Busted: How to Detect Impossible Travel | Huntress

**Impossible Travel** is presented as a location-based anomaly detection technique for identifying potential account compromise, especially using Microsoft 365 UserLoggedIn events. The post outlines a six-step pipeline (pairing events, calculating implied velocity, excluding plausible travel and normal behavior, assigning risk, and filtering low risk) and addresses key challenges such as high data volume, benign true positives from legitimate usage, and inaccuracies in geolocation data, along with recommended solutions like prioritizing logs, user baselining, and aggregating multiple location databases.