Suspicious MFA Session Replay Detection

Sagar Patel@sagar

•updated May 16, 2026•27•0•754

Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.