Okta Session Token Replay from Multiple Origins
This rule detects potential session hijacking or token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in client country, device hash (dtHash), or operating system within the same session, rather than just multiple IP addresses, to reduce false positives. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
Cortex XDR
