Skip to main content
Cyber Defense TacticsCyber Defense Tactics
HomeLearnResourcesBlogCommunity
Cyber Defense TacticsCyber Defense Tactics

Learn defensive security, leverage AI for cyber defense, and join a community of security professionals.

Learning

  • Blog
  • Resources
  • Newsletter

Community

  • Community
  • YouTube
  • About

Legal

  • Privacy Policy
  • Terms of Service

© 2026 Cyber Defense Tactics. All rights reserved.

A Carbene.AI Project

Back to D3FEND Hub
D3-UGLPA

User Geolocation Logon Pattern Analysis

Detect Tactic

Analyze user login locations to detect impossible travel, VPN anomalies, and potential account compromise.

View on MITRE D3FEND

Implementation Guidance

  • Map login geolocations
  • Calculate travel time between logins
  • Alert on impossible travel scenarios
  • Track VPN and proxy usage
  • Integrate with identity provider

Tools & Technologies

Azure AD Identity ProtectionOkta ThreatInsightDuo SecurityCrowdStrike FalconAbnormal Security

ATT&CK Techniques Countered

This defensive technique helps protect against the following adversary techniques:

T1133

External Remote Services

Explore Purple Team Matrix for full mappings

Related Techniques in Detect

D3-NTA

Network Traffic Analysis

D3-PHDM

Process Spawn Analysis

D3-FCA

File Content Analysis

D3-ANET

Authentication Event Monitoring

Ready to build a comprehensive defense strategy?