Stolen MFA Session Cookie Replayed from New IP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential session hijacking or replay attacks where a stolen MFA (Multi-Factor Authentication) session cookie is replayed from a new IP address. It specifically looks for HTTP traffic containing 'auth', 'session', or 'mfa' in the cookie header. A threshold of 5 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating suspicious activity.