Privilege Role Sign-In Outside Of Normal Hours — Detection Rule

Detects account sign ins outside of normal hours or uncommon locations. Administrator accounts should be investigated

Read the full analysis on IntelFusions