No. It is enough to flag two suspicious indicators, but not enough to reliably detect account takeover: - A new-country login may be legitimate travel, VPN, proxy use, or an inaccurate geo-IP result. - A privileged role change may be authorized administration or a compromised administrator account. Use the `OR` rule as an initial risk signal, then improve confidence through correlation: ```text new_country_login AND ( privileged_role_change within 30 minutes OR MFA reset/disablement OR new de...
Installs into .claude/skills of the current project.
Are you the author of Cyber Detection Engineering?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-detection-engineering-cec86767)
No. It is enough to flag two suspicious indicators, but not enough to reliably detect account takeover:
- A new-country login may be legitimate travel, VPN, proxy use, or an inaccurate geo-IP result.
- A privileged role change may be authorized administration or a compromised administrator account.
Use the `OR` rule as an initial risk signal, then improve confidence through correlation:
```text
new_country_login
AND (
privileged_role_change within 30 minutes
OR MFA reset/disablement
OR new device/session-token issuance
OR suspicious post-login activity
)
```
Correlate on the same account, with ordered events and a defined time window. Also require telemetry for login country, historical country, role changes, entity identity, timestamps, retention, and collection path; missing prerequisites make coverage `blocked` or `not-tested`.
For a Sigma rule, use `level: high` for impact priority and `status: test` or `experimental` until validated against fixtures and benign cases. Record scope, owner, observation time, evidence references, exclusions, and limitations. The rule’s validity or synthetic matches do not prove backend execution or effective account-takeover coverage.
