SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == "0"
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize
IPCount = dcount(IPAddress),
CountryCount = dcount(Country),
SessionCount = count(),
IPList = make_set(IPAddress, 5),
Countries = make_set(Country, 5)
by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1h)
| where CountryCount > 1 or IPCount > 2
| extend RiskSignal = "Possible AiTM Token Replay"
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPCount, CountryCount, IPList, Countries, RiskSignal
| order by CountryCount desc