Lion Cipher Lab

Detect impossible travel in sign-in logs

• SOC Analyst / Blue Team
• Intermediate
• ~45 min
• Free · no account required

Why it matters

When an attacker steals a password (phished, bought, or reused from another breach), the account itself still looks legitimate -- same username, correct password, maybe even a passed MFA prompt. The login is not malformed; it is simply being done by the wrong person. MITRE ATT&CK tracks this as T1078, Valid Accounts, and it is one of the hardest things a SOC has to catch precisely because nothing is technically 'wrong.' One of the few physical tells left is GEOGRAPHY: a real human cannot sign in from New York and, twenty-five minutes later, from Singapore. That pattern -- one account, two…

What you'll learn

• defining impossible travel -- one account signing in from two locations too far apart to have been physically travelled between in the elapsed time -- and why it is a supporting account-takeover (ATO) signal rather than a standalone verdict
• seeing WHY the naive 'alert on any new country' rule floods: against the seeded log it fires 15 times, almost all of them legitimate travellers, corporate VPN users, and mobile-carrier CGNAT -- so new-country alone is unworkable
• computing the great-circle distance between two latitude/longitude points with the Haversine formula, in pure Python (math module: radians, sin, cos, asin, sqrt) with no libraries to install
• turning distance plus elapsed time into an implied travel VELOCITY in km/h and flagging anything above an airliner ceiling (~1000 km/h), collapsing 15 noisy new-country alerts down to 6 velocity flags
• naming the real false positives that make velocity-alone over-fire: corporate VPN egress, cloud egress, and mobile-carrier CGNAT put one user in two countries with near-zero elapsed time, producing false 'infinite velocity'
• building the realistic tuning step -- an allowlist of known corporate/carrier egress ASNs -- that cuts the 6 velocity flags to 2, leaving only the genuinely impossible cases (two true account takeovers)
• recognising the blind spots this rule cannot see: a patient attacker signing in from the SAME country as the victim defeats it entirely, and geo-IP is only city-accurate, so impossible travel must be paired with other signals (unseen device, MFA failure, risky ASN)
• pinning the data in a seed script so every distance, velocity, and count is reproducible -- the same discipline a real detection rule needs so its alerts can be defended and re-tested

Steps in this lab

1. What impossible travel is -- every term, defined once
2. The naive rule, and why it will drown you
3. Seed a realistic sign-in log
4. The math: great-circle distance and implied velocity
5. Write the detector -- three rules in one tool
6. Measure the BEFORE: the naive rule floods
7. Measure the velocity rule -- better, but it over-fires
8. The honest negatives -- and the allowlist that tames them
9. When to trust this signal -- and when it lies
10. What you built -- and the reflex to keep

Open the full interactive lab →