Storm-2755 Axios Token Replay and Persistence

Tim Peck@timpeck

•updated Apr 13, 2026•28•0•1,090

Detects successful sign-ins using the axios/1.7.9 user agent. Storm-2755 uses this to replay stolen session tokens and maintain persistence via automated sign-ins approximately every 30 minutes. The rule filters for successful authentications and requires at least two authentications from the same user, IP, and user agent within the time window to identify the repeated automated persistence loop.